Cactus ransomware group lists rashtiandrashti.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Professional Services
• Announcement date: February 4, 2025

Cactus claims data breach at Rashti & Rashti

The Cactus ransomware group has listed rashtiandrashti.com on its dedicated leak site, claiming to have successfully exfiltrated a significant volume of data from the organization. According to the announcement made on February 4, 2025, the threat actors claim to have stolen a total of 786 GB of information. This follows an alleged attack date of January 24, 2025, though no specific ransom demand has been disclosed by the group.

The group is currently employing a double-extortion strategy against the organization. In such cyberattacks, threat actors do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information beforehand. The attackers then threaten to publish this stolen data on public leak sites to pressure the victim into paying a ransom. This method increases the pressure on the target, as the threat of a public data leak can cause significant reputational and legal damage, regardless of whether the organization can restore its systems from backups.

Details of the allegedly stolen data

The leak announcement provided by the Cactus group suggests that the stolen data is highly sensitive and covers a wide range of corporate and personal information. The group has shared screenshots intended to prove the validity of their claims, which reportedly include driver's licenses, I-9 employment eligibility forms, cyber insurance questionnaires, and financial account statements.

The specific types of data allegedly involved in this breach include:

• Personally identifiable information
• Database backups
• Corporate documents
• Contracts
• NDAs
• Financial data
• Correspondence
• Sales and marketing data
• Driver's licenses
• Employment records

About Rashti & Rashti

Rashti & Rashti is a third-generation family-owned business that manufactures baby products worldwide. Operating in the baby apparel and accessories sector, the company produces its items with individual care and integrity. The organization is based in the United States and operates within the professional services sector.

Potential risks and security implications

The exfiltrated data may pose secondary risks such as identity theft and targeted phishing attacks for the organization's employees and customers. Given that the organization is based in the US, the breach may lead to legal consequences under state-level data breach notification laws and relevant regulations. It is possible that the data could be shared on wider platforms or that ransom demands could escalate in the future.

It is known that the Cactus group exploits VPN vulnerabilities to gain network access. Security deficiencies noted in the organization's cyber insurance questionnaire may have contributed to the success of the attack. This incident highlights how vulnerabilities in remote access tools can serve as an entry point for sophisticated ransomware groups. Such breaches can negatively impact an organization's operational continuity and reputation.

For organizations operating in similar sectors, maintaining robust security posture is essential. This includes securing remote access points, such as VPNs, and ensuring that security controls documented in insurance questionnaires are strictly implemented and regularly audited. Protecting sensitive employee and customer data is critical to preventing the secondary harms of identity theft and phishing that often follow a data exfiltration event.