Cactus ransomware group lists midwayimporting.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: February 18, 2025

Cactus ransomware group claims breach of Midway Importing

The Cactus ransomware group has officially listed the United States-based company Midway Importing on its leak site. According to the announcement made on February 18, 2025, the threat actor group claims to have successfully exfiltrated corporate data from the organization. The group asserts that the initial access and subsequent attack occurred on January 16, 2025, though the exact details regarding the method of entry were not specified in the announcement.

In line with common ransomware leak site practices, the group has provided various documents as proof of the breach. These shared files are intended to demonstrate that the attackers have indeed gained access to the internal systems of Midway Importing. This type of public shaming is a hallmark of modern cyber extortion, where the threat of leaking sensitive information is used to pressure the victim into meeting ransom demands.

Data types involved in the alleged leak

The announcement from the Cactus group details a significant volume of sensitive information that has purportedly been compromised. The leaked data is said to encompass a wide range of corporate and personal information, suggesting a deep penetration into the company's digital infrastructure. The group claims to have accessed various sensitive directories and files, including:

• Personally identifiable information
• Employee data
• Executive data
• Financial documents
• Corporate correspondence
• HR data
• Tax forms

To support these claims, the group has released screenshots containing samples of sensitive documentation. These samples reportedly include identity cards, tax forms, and various financial statements, which serve as evidence of the data they have collected from the victim's environment.

About Midway Importing

Midway Importing is a leading distributor operating in the United States. The company specializes in the distribution of Hispanic health and beauty care products. For over 25 years, the organization has been providing a specialized mix of brands to Hispanic consumers. Beyond product distribution, the company provides comprehensive merchandising and marketing services to support its brand portfolio.

Analysis and organizational implications

The exposure of this data presents several critical risks to the organization and the individuals involved. The leak of personally identifiable information belonging to both employees and executives poses a direct risk of identity theft. Furthermore, the publication of confidential agreements and financial data could potentially impact the company's trade secrets and competitive standing. Because the company operates within the United States, the incident may trigger various state-level data protection laws and potential legal sanctions.

This incident highlights the dangers of double-extortion tactics, a method frequently employed by ransomware groups like Cactus. In a double-extortion scenario, attackers not only encrypt a company's data to disrupt operations but also steal sensitive information to threaten its public release. This stolen data can be used for targeted phishing attacks against employees or the company's partners, leveraging the specific details found in the leaked correspondence and HR files.

While public information regarding the specific operations of the Cactus group remains limited, there have been reports suggesting that such groups may exploit vulnerabilities in VPNs to gain initial network access. This underscores the importance for organizations to maintain rigorous security postures. To mitigate such risks, companies should prioritize regular patching of all external-facing services, implement multi-factor authentication across all access points, and maintain robust monitoring to detect unauthorized lateral movement within the network. For organizations in the retail and distribution sectors, ensuring that database backups and cloud storage, such as OneDrive, are secured with strict access controls is a vital defensive step.