Cactus ransomware group lists formanmills.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: February 24, 2025

Cactus ransomware group claims breach of Forman Mills

The threat actor known as Cactus has listed the American retailer formanmills.com on its dedicated leak site. According to the group's announcement, which was posted on February 24, 2025, the attackers claim to have successfully gained unauthorized access to the organization's internal systems. This breach, which the group alleges began around February 6, 2025, involves the exfiltration of various types of corporate data. To support their claims of a successful intrusion, the group has published a portion of the alleged stolen data as proof of the breach.

Ransomware leak sites function as a platform for cybercriminals to pressure victims into paying ransoms by threatening to release sensitive information. This specific incident follows the pattern of double extortion, a tactic where attackers not only encrypt a victim's systems to disrupt operations but also steal sensitive data to use as leverage during negotiations. By threatening to leak confidential information, the attackers aim to maximize their bargaining power, even if the victim has robust backup and recovery procedures in place.

Details of the alleged data exfiltration

The Cactus group claims to have stolen a wide variety of sensitive information during their intrusion. Based on the screenshots provided by the threat actors, the stolen data includes highly sensitive documents such as identification cards, passports, and employment contracts. These documents are particularly valuable to cybercriminals as they provide the necessary components for identity theft and sophisticated social engineering attacks.

The group further claims that the exfiltrated data includes the following categories of information:

• Identity information
• Passport data
• Employment contracts
• Employee and executive personal data
• Financial data
• Corporate correspondence

The exposure of such diverse data types—ranging from personal identification to internal corporate communications—presents a significant risk to the organization. When sensitive documents like passports and employment contracts are leaked, it creates a long-term security liability for the individuals involved, as this information is difficult to change and can be used for fraudulent purposes over an extended period.

About Forman Mills

Forman Mills is an American warehouse retailer founded in 1977. The company is based in New Jersey and specializes in offering men's, women's, and children's apparel at off-price points. As a large-scale retailer, the organization manages a significant volume of consumer and employee information to support its business operations.

Potential impacts and security implications

The Cactus group has been active since 2023 and is known for utilizing vulnerabilities in VPNs to gain initial access to corporate networks. This specific incident highlights the ongoing risks faced by large organizations, where a single point of entry can lead to the compromise of vast amounts of sensitive data. For a retail organization, the exposure of financial and corporate data can lead to significant operational disruptions and reputational damage.

Furthermore, the breach carries potential legal and regulatory consequences. Given that the organization is based in the United States, the leak of personal and financial data may trigger investigations and legal actions under various state-level data protection laws and through various regulatory bodies. The risk of identity theft and targeted phishing attacks against the organization's employees and executives is also significantly increased following such a breach.

In response to such threats, organizations in the retail sector typically focus on strengthening their perimeter defenses. This includes implementing multi-factor authentication (MFA) across all remote access points, such as VPNs, and ensuring that all software and hardware are regularly patched to prevent the exploitation of known vulnerabilities. Additionally, robust data loss prevention (DLP) strategies and continuous monitoring of network traffic can help detect and mitigate unauthorized data exfiltration attempts before they result in a major breach.