Cactus ransomware group lists se.com on its leak site

• Ransomware group: Cactus
• Country: France
• Sector: Technology
• Announcement date: February 19, 2024

The Cactus ransomware group has officially listed Schneider Electric on its dedicated leak site. According to the threat actor, the breach involves a significant volume of stolen information, with the group claiming to be in possession of 1.5TB of data belonging to the organization.

The claims made by the Cactus group

The Cactus group added the organization to its leak site on February 19, 2024. Based on the claims made by the threat actors, they managed to gain unauthorized access to the organization's network as early as January 17, 2024. This suggests that the attackers may have maintained a presence within the network for several weeks before the public announcement was made.

To substantiate their claims of a successful intrusion, the group has published a portion of the stolen data as proof of the breach. The group alleges that they have successfully exfiltrated a vast amount of the organization's files, which they are now using to pressure the entity through their leak site platform.

Affected data types

The samples shared by the attackers on the leak site indicate that the stolen information includes a variety of sensitive materials. The following data types have been identified in the leaked samples:

• Passport data
• Non-disclosure agreements
• Corporate partnership documents

Organization profile

Schneider Electric is a French multinational company providing energy management and industrial automation solutions. The company specializes in digital automation and energy efficiency technologies.

Analysis and implications of the breach

The Cactus group is known for employing double-extortion tactics. In such scenarios, attackers do not merely encrypt a victim's systems; they also steal sensitive data and threaten to release it publicly unless a ransom is paid. The publication of exfiltrated data in this manner can create significant operational risks for an organization. When personal information is exposed, it significantly increases the risk of identity theft and targeted phishing attacks for the individuals whose data was compromised.

Because the organization is based in France, this incident may lead to investigations regarding data protection breaches under the General Data Protection Regulation (GDPR). Furthermore, the exposure of documents containing trade secrets and partnership agreements could potentially impact the organization's various supply chain partners.

There is information suggesting the group may have utilized vulnerabilities in VPNs to gain initial access to the network. Such a method of entry highlights the critical importance of robust network security processes. For organizations in the technology and industrial automation sectors, maintaining rigorous security protocols is essential to defend against such threats. Common defensive measures often include the implementation of multi-factor authentication, regular patching of edge devices like VPNs, and continuous monitoring of network traffic to detect unauthorized lateral movement or large-scale data exfiltration attempts.