Cactus ransomware group lists rocketstores.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: March 12, 2025

Cactus ransomware group claims data breach at rocketstores.com

The threat actor known as the Cactus ransomware group has listed data allegedly belonging to rocketstores.com on its dedicated leak site. According to the announcement made on March 12, 2025, the group claims to have successfully exfiltrated a massive volume of information from the organization.

The group asserts that the total amount of data stolen is 3.2TB. While the specific details regarding a ransom demand were not provided in the announcement, the scale of the claimed theft suggests a significant breach of the organization's digital infrastructure. The alleged attack occurred on February 26, 2025, according to the claims made by the threat actors.

Details of the claimed data exfiltration

The announcement made by the Cactus group suggests that the stolen information is highly sensitive and covers various aspects of the organization's internal operations. The group claims to have obtained a wide array of files that could impact both the company and its personnel. The content of the leak reportedly includes internal corporate correspondence, financial records, and various forms of employee information.

Based on the information provided by the threat actor, the following types of data are allegedly involved in the breach:

• Personally identifiable information
• Employee data
• Financial data
• Legal documents
• Corporate correspondence

Furthermore, the group has provided screenshots as evidence of the breach. These visual samples reportedly display various legal correspondence, incident reports, and samples of employment agreements, indicating that the stolen data includes contracts and non-disclosure agreements (NDAs), payroll information, and personal data belonging to both employees and executives.

About rocketstores.com

Rocket Stores is a large independent operator of gas stations and convenience stores located in the Western United States. Founded in 1955, the company maintains a significant presence in the region, serving over 450 locations across the states of California, Oregon, Washington, and Colorado.

Potential risks and security implications

The exposure of such sensitive information carries significant risks for the organization and the individuals involved. For the employees and executives of Rocket Stores, the leak of personal data may lead to secondary risks, including identity theft and the possibility of targeted phishing attacks. Such attacks often leverage stolen personal details to gain further access to corporate systems or to defraud individuals.

Because the organization operates within the United States, the exposure of this data may result in legal consequences under various state-level data privacy laws. The breach could trigger specific regulatory requirements depending on the nature of the data and the jurisdictions in which the company operates. Additionally, the exposure of sensitive financial data presents a long-term risk, as such information could potentially be exploited by other cybercriminal groups in the future.

The Cactus group is known for employing double-extortion tactics, a method where attackers not only encrypt an organization's data but also steal it to threaten the victim with public disclosure unless a ransom is paid. This group is also recognized for gaining initial access to networks through vulnerabilities in VPN services. Such tactics can severely impact an organization's operational continuity and its commercial reputation.

To mitigate these types of risks, organizations in the retail and e-commerce sectors often focus on strengthening their defensive posture. This typically involves implementing robust multi-factor authentication (MFA), ensuring all VPN and remote access solutions are patched against known vulnerabilities, and maintaining strict monitoring of data exfiltration patterns. Protecting sensitive financial and personal data is critical to maintaining consumer trust and ensuring compliance with evolving privacy regulations.