Cactus ransomware group lists leonardssyrups.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Professional Services
• Announcement date: July 30, 2024

The Cactus ransomware group has listed 575 GB of data, allegedly belonging to leonardssyrups.com, on their dedicated leak site. This announcement, made on July 30, 2024, marks a significant escalation in the threat actor's campaign against the organization.

Details of the claimed attack

According to the claims made by the Cactus ransomware group, the breach occurred earlier in the summer. The threat actor asserts that they obtained access to the institution's network systems on July 5, 2024. This period of unauthorized access precedes the public listing of the data by several weeks.

The group appears to be employing a double extortion tactic. In such scenarios, ransomware actors do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information. By threatening to publish this stolen data on a public leak site, the attackers attempt to exert maximum pressure on the organization to meet their demands. This method increases the stakes for the victim, as the threat shifts from mere operational downtime to permanent reputational and legal damage through public exposure.

Data involved in the leak

The leak announcement specifies that a wide variety of sensitive information has been compromised. The stolen data reportedly includes employee personal and corporate information, financial documents, customer records, contracts, and database exports. To support their claims, the group has provided screenshots containing samples of highly sensitive documents, such as passports, driver's licenses, social security cards, and disciplinary records.

Affected data types

• Employee personal data
• Corporate data
• Financial documents
• Customer data
• Contracts
• Identity information

About Leonard's Syrups

Leonard's Syrups is an American company specializing in the supply and distribution of syrups, carbon dioxide, and related equipment for soda fountain machines. It provides beverage solutions for restaurants and other businesses.

Impact and security assessment

This data breach poses significant risks to both the institution and the individuals involved. The exposure of identity information, such as social security cards and driver's licenses, creates a high risk of identity theft and fraud for the organization's employees and customers. Furthermore, the publication of this data could negatively impact the institution's commercial reputation and increase supply chain risks for its business partners.

From a technical perspective, the Cactus group is known for exploiting vulnerabilities in VPNs to gain initial access to networks. This suggests that the institution may have had weaknesses in its network security processes. Additionally, the leaked data could potentially be utilized by threat actors to launch targeted phishing attacks against the company or its clients.

Because the institution is based in the United States, this incident may trigger legal obligations. Data breach notification requirements under relevant state laws and federal regulations may arise depending on the nature of the compromised information. To mitigate such risks, organizations in similar sectors often focus on strengthening network security, implementing multi-factor authentication, and ensuring robust patch management for remote access tools like VPNs to prevent unauthorized entry.