Cactus ransomware group lists kelson.on.ca on its leak site

• Ransomware group: Cactus
• Country: Canada
• Sector: Professional Services
• Announcement date: March 22, 2024

Cactus group claims data leak at Kelson

The Cactus ransomware group has announced a data breach involving the Canadian organization kelson.on.ca. According to an announcement posted on a leak site on March 22, 2024, the threat actor group claims to have compromised various datasets belonging to the firm. The group asserts that they have exfiltrated sensitive information and is reportedly demanding a ransom for the return or non-disclosure of the data.

The incident, which the group claims began around March 12, 2024, follows a pattern of behavior observed with this specific threat actor. The Cactus group, which first emerged in 2023, is known within the cybersecurity community for its tactics, which frequently include the exploitation of vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to corporate networks. This method allows attackers to bypass traditional perimeter defenses and move laterally through an organization's infrastructure.

Details of the alleged data theft

The claims made by the Cactus group suggest a wide-ranging compromise of the organization's digital assets. Based on available records and screenshots provided by the attackers, the breach reportedly encompasses a variety of highly sensitive documents and databases. The scope of the alleged theft includes critical business intelligence, financial records, and private information belonging to both the company and its personnel.

The specific types of data the group claims to have stolen include:

• Accounting and payroll documents
• Personally Identifying Information
• Engineering and QA data
• Project and confidential design documents
• Contracts and tenders
• Customer data
• Employee and executive personal folders
• Database exports

The inclusion of such diverse data types suggests that the attackers may have gained significant access to the organization's internal file servers and databases, potentially impacting multiple departments ranging from finance and human resources to engineering and project management.

About Kelson

Kelson is a Canada-based engineering and consulting firm. It provides technical solutions and project management services, particularly for infrastructure, construction, and industrial projects. Given the nature of its business, the firm handles complex technical documentation and significant project-related data necessary for large-scale industrial and infrastructure developments.

Potential impact and organizational risks

The nature of the data mentioned in the claim poses significant risks to the organization's operational processes and customer confidentiality. The exposure of project and confidential design documents could disrupt ongoing technical operations, while the leak of personally identifiable information (PII) can lead to serious consequences for individuals, such as identity theft and highly targeted phishing attacks.

The group is reported to be utilizing double extortion, a tactic where attackers not only encrypt an organization's systems but also threaten to release stolen data publicly to increase pressure. This method significantly increases the stakes for the victim, as the threat of a data leak remains even if the organization can restore its systems from backups. For a firm like Kelson, such an incident may necessitate a thorough review regarding data protection obligations under Canadian regulations and could potentially impact the organization's commercial reputation and customer trust.

In the professional services and engineering sectors, organizations often face high risks due to the sensitive nature of their intellectual property and client data. To mitigate such risks, industry experts generally recommend implementing robust security measures. These include maintaining strict patch management for all external-facing services, particularly VPNs, implementing multi-factor authentication (MFA) across all access points, and adhering to the principle of least privilege to limit the movement of attackers within a network. Furthermore, regular monitoring of network traffic and the implementation of comprehensive data loss prevention (DLP) strategies can help identify and prevent unauthorized data exfiltration before it reaches a critical scale.