Cactus ransomware group lists savoiesfoods.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: February 6, 2025

Cactus ransomware group claims data breach at Savoie's Foods

The Cactus ransomware group has claimed responsibility for a cyberattack against the United States-based food producer Savoie's Foods. In an announcement posted on a leak site on February 6, 2025, the threat actor group asserted that they have compromised the organization's data and released a portion of it as proof of the breach.

According to the claims made by the Cactus group, the incident occurred on January 28, 2025. The group has stated that the volume of data stolen is approximately 95 GB. While the group has provided sample images to support their claims, they have not provided information regarding a ransom demand or the specific number of files involved in the breach.

Details of the claimed data theft

The threat actor group has provided several sample images to demonstrate the nature of the stolen information. These samples include sensitive documents such as independent accountant review reports, confidentiality agreements, financial statements, a driver's license, and W-2 tax forms. The group claims that the breach involves a wide range of sensitive information, including:

• Personal identifiable information
• Database backups
• Outlook backups
• Employee and executive documents
• Corporate correspondence
• Financial data
• Customer agreements
• Tax forms
• Identity documents

Ransomware attacks of this nature often involve double-extortion tactics. In such scenarios, attackers do not just encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to leak private information on public forums or leak sites, attackers aim to pressure the victim into paying a ransom to prevent the exposure of sensitive corporate or personal data.

About Savoie's Foods

Savoie's Foods is a food company that creates authentic Cajun products using family recipes handed down for generations. They offer products such as roux, smoked sausage, boudin, and tasso in grocery stores and restaurants.

Impact and security implications

The inclusion of highly sensitive documents, such as W-2 forms and personal identification, in the leaked samples poses a significant risk to the individuals involved. Specifically, the exposure of such data increases the risk of identity theft and makes employees and customers targets for highly specific, targeted phishing attacks. Because the organization is based in the United States, this breach may lead to legal consequences under various state-level data protection laws and relevant regulatory frameworks.

Furthermore, the exposure of financial and operational data could potentially impact the company's commercial reputation and the security of its supply chain. For organizations in the food production sector, maintaining the integrity of operational data is critical for maintaining trust with distributors and retail partners.

Cactus is known for exploiting vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to corporate networks. Once inside, they move through the network to identify and exfiltrate high-value data. Given the history of this group, there is a possibility that the compromised data may be further disseminated or sold on criminal forums in the future.

To defend against such threats, organizations typically focus on securing remote access points, such as VPNs, through multi-factor authentication and regular vulnerability patching. Additionally, implementing robust data encryption and maintaining offline, immutable backups can help mitigate the impact of both data exfiltration and encryption-based ransomware attacks.