Cactus ransomware group lists thermoid.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Manufacturing
• Announcement date: March 12, 2025

Cactus ransomware group claims data breach at Thermoid

The Cactus ransomware group has published an announcement on its dedicated leak site, claiming responsibility for a data breach targeting the United States-based company Thermoid. According to the threat actor, the breach occurred around February 12, 2025, and the announcement was officially posted on their platform on March 12, 2025. The group alleges that they have successfully exfiltrated a significant volume of information from the organization's internal systems.

The threat actor claims to have obtained approximately 199 GB of data. While the specific file count was not provided in the announcement, the group has provided sample files to support their claims. This type of activity is characteristic of modern ransomware operations, where attackers do not merely encrypt files to disrupt operations but also focus on stealing sensitive information to use as leverage during negotiations.

Details of the claimed data theft

Based on the screenshots and information shared by the Cactus group in their announcement, the stolen data appears to be highly sensitive, spanning both corporate and personal information. The group alleges that the compromised data includes critical engineering assets and private employee records. The presence of such diverse data types suggests a deep level of access into the organization's network.

The specific types of data mentioned in the claim include:

• Engineering data
• Employee personal data
• SSN (Social Security Number)
• Financial documents
• Corporate correspondence

The group has shared screenshots that purportedly show engineering technical drawings, confidentiality agreements, and employee drug screening reports, which reportedly include Social Security Numbers. This combination of technical intellectual property and highly sensitive personal identifiers significantly increases the potential impact of the breach.

About Thermoid

HBD Thermoid is an American company that has been in operation since 1883. Headquartered in Dublin, Ohio, the organization specializes in the manufacturing of industrial rubber products. Their product line includes various industrial components such as hoses, industrial ducting, and conveyor belting. Given its long history and specialization in industrial manufacturing, the company serves as a key player in its specific industrial sector.

Analysis and implications of the attack

The Cactus group appears to be employing a double-extortion model in this incident. In a double-extortion scheme, attackers first exfiltrate sensitive data and then threaten to release it publicly to pressure the victim into paying a ransom. By threatening to expose proprietary information and private employee data, the group aims to maximize the reputational and legal pressure on the organization.

The exposure of personal information, particularly Social Security Numbers, poses a severe risk to the affected individuals, as it can lead to identity theft and highly targeted phishing attacks. Furthermore, the disclosure of engineering and commercial data can result in the loss of intellectual property, which may diminish the company's competitive advantage in the manufacturing market. As a US-based entity, Thermoid may also face legal obligations and consequences under various state-level data protection laws due to the exposure of personal information.

Reports regarding the Cactus group suggest that they may utilize vulnerabilities in VPNs to gain initial access to corporate networks. This highlights a critical need for organizations to maintain rigorous network security processes. To defend against such threats, organizations in the manufacturing sector should prioritize robust patch management for remote access tools, implement strict multi-factor authentication, and maintain comprehensive monitoring of their network to detect unauthorized data exfiltration early.