Cactus ransomware group lists gocco.com on its leak site

• Ransomware group: Cactus
• Country: Spain
• Sector: Professional Services
• Announcement date: February 6, 2024

The Spanish-based retail firm gocco.com has been listed on the leak site of the Cactus ransomware group. According to the announcement made on February 6, 2024, the threat actor claims to have successfully targeted the organization, alleging that they gained unauthorized access to the company's networks and exfiltrated a significant volume of data.

The claimed attack and data exfiltration

The threat actor known as Cactus claims to have stolen 136 GB of data belonging to gocco.com. The group alleges that the breach occurred around January 19, 2024. While the specific method of initial entry was not detailed in the announcement, the group has a known history of utilizing vulnerabilities in Virtual Private Networks (VPNs) to gain access to corporate networks.

The group employs a tactic known as double extortion. In these types of cyberattacks, threat actors do not merely encrypt a victim's files to demand a ransom for decryption; they also steal sensitive information beforehand. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the organization into paying the ransom. By publishing samples of the stolen information, the attackers aim to prove the validity of their claims and increase the pressure on the victim.

Data samples and affected information

The announcement on the Cactus leak site includes various samples of documents that the group claims are related to the organization's operational processes. These samples provide a glimpse into the types of information the attackers claim to have obtained. The following items have been identified as part of the data involved in this alleged breach:

• Audit reports
• Confidentiality agreements
• Employee and third-party identification data

The presence of such sensitive documents, including images of Spanish national identification cards, highlights the potential severity of the exposure. Such data can be highly valuable to malicious actors for various illicit purposes.

About Gocco

Gocco is a Spanish-based retail fashion brand that designs, manufactures, and sells clothing for babies and children. The company operates in the international market through both physical stores and e-commerce channels.

Analysis and potential impact

The exposure of sensitive identification documents carries significant risks. For the organization, the leak of such data may increase the risk of identity theft and targeted phishing attacks directed at the organization's employees or its business partners. When personal identification information is compromised, attackers can craft highly convincing social engineering campaigns to further penetrate the network or defraud individuals.

Furthermore, the publication of commercial confidentiality agreements could potentially impact supply chain security and might result in reputational damage for the organization. For a company operating in the international retail market through both physical and digital channels, maintaining the trust of customers and partners is essential.

Because the organization is based in Spain, this breach may lead to legal consequences under the European Union's General Data Protection Regulation (GDPR). Organizations operating within the EU must adhere to strict data protection standards, and failures in securing personal data can result in substantial regulatory penalties.

To defend against such threats, organizations in the retail and professional services sectors often implement various security measures. These include strengthening VPN security, implementing multi-factor authentication (MFA), and conducting regular audits to identify vulnerabilities. Continuous monitoring of network traffic and robust data encryption strategies are also common defensive steps used to mitigate the risk of exfiltration and subsequent extortion attempts.