Cactus ransomware group lists ottosimon.co.uk on its leak site

• Ransomware group: Cactus
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: November 8, 2024

Cactus ransomware group claims data breach at Ottosimon

The Manchester-based engineering consultancy firm Ottosimon has been listed on the leak site of the Cactus ransomware group. According to the announcement made on November 8, 2024, the threat actor known as Cactus claims to have gained unauthorized access to the organization's systems. The group asserts that they have published various types of corporate and personal data on their dedicated leak platform following the alleged attack, which is claimed to have occurred on October 30, 2024.

The threat actor claims that a significant volume of information has been compromised. Specifically, the group has provided a portion of the data as proof of the breach, alleging that the total size of the stolen data reaches 1.9TB. While the group has made these claims on their platform, no information was provided regarding a specific ransom demand.

Details of the alleged data theft

The announcement made by the Cactus group suggests a wide-ranging compromise of sensitive information. The stolen data is claimed to include a variety of critical files that could impact both the company and the individuals associated with it. Based on the group's claims, the following types of information have been exposed:

• Personally identifiable information
• Employee and executive data
• Customer information
• Financial documents
• Corporate correspondence
• Project drawings

Beyond the general categories, the group has provided screenshots as evidence of the breach. These visual proofs reportedly display sensitive documents, including samples of passports, driving licenses, and non-disclosure agreements. The presence of such documents suggests that the breach extends into highly sensitive personal identification and legal documentation.

About Ottosimon

Ottosimon is an independent specialist engineering consultancy and project delivery organisation based in Manchester. Specializing in commercial and residential construction projects, they provide services with a team of experienced professionals.

Potential impact and industry risks

This incident highlights the significant risks associated with modern ransomware tactics. The exposure of such a vast amount of data may pose secondary risks, such as identity theft or targeted phishing attacks, for the organization's employees and customers. Furthermore, the exposure of corporate data and project drawings could potentially impact the company's commercial operations and competitive standing.

Because the organization is a UK-based entity, the incident may be subject to investigation by data protection authorities under the UK GDPR. The Cactus group is known for employing double extortion tactics, a method where attackers not only encrypt an organization's data but also threaten to leak it to pressure the victim into paying. This group is also known to exploit VPN vulnerabilities to gain initial access to networks.

In such scenarios, the operational continuity of an organization may be at risk. For companies in the professional services and engineering sectors, protecting intellectual property like project drawings and maintaining the confidentiality of client and employee data is vital. Organizations facing similar threats often focus on strengthening their perimeter defenses, particularly regarding remote access points, and ensuring robust backup strategies are in place to mitigate the impact of encryption-based attacks.