Cactus ransomware group lists newhorizonsbaking.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: February 20, 2025

Cactus ransomware group claims attack on New Horizons Baking

The Cactus ransomware group has officially listed data allegedly belonging to New Horizons Baking on its dedicated leak site. According to the announcement made on February 20, 2025, the threat actor group claims to have obtained sensitive information from the organization following a cyber incident that they state occurred on January 21, 2025.

The group has published a sample set of the institution's operational and personal data on its leak site to support their claims. This public exposure suggests that an unauthorized access to the institution's network infrastructure may have taken place, allowing the attackers to exfiltrate various types of internal information.

Data types involved in the alleged breach

The information allegedly stolen by the Cactus group encompasses a wide range of sensitive materials. Based on the group's announcement, the data involved includes various organizational and personal files that could impact both the company's operations and the privacy of its personnel. The types of data identified in the listing include:

• Personally Identifiable Information
• Employee HR data
• Financial data
• Payroll records
• Corporate contracts

The scope of the leaked content further includes database backups, corporate confidential documents, agreements, HR department data, personal folders belonging to employees and executives, and various forms of corporate correspondence.

About New Horizons Baking

New Horizons Baking is a bakery company that produces hamburger buns and English muffins for iconic brands. The company focuses on producing high-quality bakery products and is headquartered in Norwalk, Ohio.

Analysis and industry implications

Given the Cactus group's known use of double-extortion tactics, the public release of the stolen data may increase the risk of identity theft for the institution's employees and executives. In a double-extortion scenario, attackers not only encrypt a victim's systems but also threaten to leak sensitive data to pressure the organization into paying a ransom. This method places significant pressure on companies to prevent the public disclosure of private information.

The exposure of corporate financial data and contracts could potentially damage the institution's competitive position and lead to a loss of trust among supply chain partners. Furthermore, as the institution is based in the United States, legal proceedings and administrative sanctions under relevant state laws and federal data privacy regulations may follow the incident.

The Cactus group is known to exploit VPN vulnerabilities to gain network access. This specific method of entry highlights a persistent risk for other organizations within the same sector. To mitigate such risks, organizations typically focus on securing remote access points, implementing multi-factor authentication, and maintaining robust monitoring of network infrastructure to detect unauthorized access attempts early.