Cactus ransomware group lists regulvar.com on its leak site

• Ransomware group: Cactus
• Country: Canada
• Announcement date: February 24, 2025

Cactus claims data breach at Regulvar

The Cactus ransomware group has officially listed the Canadian organization Regulvar on its dedicated leak site. According to the announcement made on February 24, 2025, the threat actor claims to have successfully breached the company's systems. The group alleges that the initial unauthorized access to the organization's network occurred on February 16, 2025, approximately one week before the public listing of the victim on their platform.

In line with common ransomware tactics, the threat actors have provided a portion of the stolen files as proof of the breach to validate their claims. This method is frequently used by cybercriminal groups to demonstrate the legitimacy of their intrusion and to exert maximum pressure on the targeted entity during negotiations.

Alleged data exfiltration and contents

The threat actor claims to have exfiltrated a wide variety of sensitive information, spanning both corporate and personal records. The scope of the alleged data theft is extensive, involving documents that could impact the operational integrity and privacy of the organization. The group has released screenshots as evidence, which reportedly include identification documents and various financial forms.

The specific types of data allegedly stolen include:

• Personally identifiable information
• Financial documents
• Payroll
• Engineering data
• Corporate correspondence
• Agreements

By targeting such a diverse range of data, including engineering projects and internal communications, the attackers aim to maximize the impact of the leak. This type of exposure can lead to significant operational and reputational challenges for the victimized organization.

About Regulvar

Regulvar is a company based in Canada that specializes in building automation and control systems. The organization provides a variety of essential services for commercial and industrial buildings, including energy management, HVAC control, and comprehensive building automation solutions. Their role in managing critical infrastructure components makes them a significant player in the building management sector.

Analysis and potential implications

The actions taken by the Cactus group highlight the ongoing threat of double-extortion tactics. In these scenarios, attackers do not just encrypt data to disrupt operations; they also steal sensitive information to threaten its public release. This dual approach significantly increases the risk for both the organization and its stakeholders. For Regulvar, the exposure of such data could lead to heightened risks of identity theft and targeted phishing attacks directed at both employees and clients.

Furthermore, the exposure of engineering data and corporate projects could potentially impact the organization's competitive position in the market. Because the organization operates within Canada, this incident may trigger regulatory obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how organizations must handle and report breaches involving personal information.

The Cactus group, which emerged in 2023, is known for exploiting vulnerabilities in VPNs to gain entry into networks. Their use of data leaks is a calculated move to pressure organizations into paying ransoms. To defend against such threats, organizations in the building automation and industrial sectors should focus on robust identity and access management, particularly regarding remote access solutions like VPNs. Implementing strict multi-factor authentication, maintaining regular offline backups, and conducting thorough network segmentation are also vital defensive steps to mitigate the impact of potential breaches.