Cactus ransomware group lists sunrise-soya.com on its leak site

• Ransomware group: Cactus
• Country: Canada
• Sector: Agriculture and Food Production
• Announcement date: January 30, 2025

Cactus ransomware group claims breach of Sunrise Soya Foods

The Cactus ransomware group has published a claim on its leak site involving the Canadian food manufacturer Sunrise Soya Foods. According to the announcement made on January 30, 2025, the threat actor group asserts that they have successfully targeted the organization and have exfiltrated a significant volume of sensitive information.

The threat actor claims to have gained unauthorized access to the organization's network on January 21, 2025. Following this initial access, the group asserts that they exfiltrated a total of 504 GB of data. To support their claims, the group has published a portion of the stolen data on their platform as proof of the breach. No information was provided regarding a ransom demand.

Details of the claimed data exfiltration

The data samples shared by the Cactus group in their announcement indicate a wide range of sensitive information has been compromised. The leaked content reportedly includes highly personal and corporate documents that could pose significant risks to the individuals and the entity involved. The specific types of data mentioned in the listing include:

• Employee personal data
• Identity documents
• Financial data
• HR documents
• Corporate correspondence

The specific contents of these samples include employee contact lists, personal identification documents such as passports and driver's licenses, criminal record checks, and the organization's annual income statements.

About Sunrise Soya Foods

Sunrise Soya Foods is a leading Canadian manufacturer of tofu and soy products, established in 1956. The company specializes in producing nutritious soy products using traditional methods and is recognized as the largest tofu manufacturer in Canada.

Analysis and potential impact of the breach

The publication of this data by the Cactus group introduces several layers of risk. For the employees and executives of Sunrise Soya Foods, the leak of identity documents and personal contact information may lead to secondary risks, such as identity theft and the execution of targeted phishing attacks. These types of attacks often leverage stolen personal details to gain trust and manipulate victims into revealing further credentials or funds.

From a regulatory perspective, as a Canada-based entity, the breach may result in legal consequences under local data protection regulations, such as the Personal Information Protection and Electronic Documents Act (PIPEDA). Furthermore, the publication of the organization's financial data, including annual income statements, could lead to a loss of competitive advantage and significant reputational damage. Given the sensitive nature of the information involved, disruptions in the organization's operational processes may be observed.

The Cactus group is known to be an actor that typically exploits VPN vulnerabilities to gain network access and employs double extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release unless a ransom is paid. This tactic increases the pressure on organizations by targeting their reputation and regulatory compliance.

In general, organizations in the food production sector can take several defensive steps to mitigate such risks. Implementing multi-factor authentication (MFA) across all remote access points, such as VPNs, is a critical defense against unauthorized access. Regularly patching vulnerabilities in edge devices and maintaining strict network segmentation can also help limit the movement of an attacker within a network. Additionally, robust data encryption and comprehensive employee training on phishing awareness are essential components of a modern cybersecurity posture.