Cactus ransomware group lists www.amchar.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Professional Services
• Announcement date: September 25, 2024

Cactus ransomware group claims breach of AmChar Wholesale

The Cactus ransomware group has officially listed the American company AmChar Wholesale on its dedicated leak site. According to the announcement made on September 25, 2024, the threat actor group claims to have successfully executed a cyberattack against the organization, resulting in a significant data breach. The group alleges that the intrusion occurred around September 17, 2024, and they have asserted that they obtained approximately 605 GB of data belonging to the victim organization.

To support their claims of a successful breach, the Cactus group has provided various documents as proof. These documents are claimed to be part of the company's internal operational records. While the group has posted these files to demonstrate their access, the full extent of the breach and the authenticity of all claims remain subject to verification.

Alleged data contents and sensitive information

The data allegedly stolen by the Cactus group is reported to be quite extensive and contains a wide variety of sensitive information. Based on the group's claims, the leaked dataset includes highly sensitive documents that could pose significant risks to the individuals and the entity involved. The information reportedly encompasses a range of categories, including:

• Personally identifiable information
• Financial documents
• Employee personal data
• Customer information
• Corporate contracts

Furthermore, the group has shared screenshots intended to prove the depth of their access. These images reportedly show sensitive content such as driver's licenses, social security cards, and cyber insurance application forms. The presence of such highly personal documentation suggests a significant compromise of private records.

About AmChar Wholesale

AmChar Wholesale is an American company that has been in operation since 1980. Headquartered in Rochester, New York, the organization specializes in the distribution of firearms and related equipment. Their client base primarily consists of law enforcement entities and independent dealers, making them a specialized player within the professional services sector of the firearms industry.

Analysis and potential implications of the attack

The Cactus group is known for employing double-extortion tactics. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to publish the stolen information on a leak site, the group attempts to pressure the victim into paying a ransom to prevent the public release of the data. Given the nature of the alleged leak, the publication of this information may increase the risk of identity theft for both the company's employees and its customers.

Because AmChar Wholesale operates within the firearms industry, the leaked data could potentially be leveraged for highly targeted phishing attacks or could introduce significant supply chain risks. The specific nature of their business means that the information stolen could be used to target other entities within their professional network.

As a United States-based entity, this incident may trigger various data privacy compliance processes mandated by relevant state laws and federal regulations. Furthermore, the Cactus group has a known tendency to exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to networks. This suggests that organizations facing similar threats may need to conduct a comprehensive review of their network security infrastructure, particularly regarding remote access points, to mitigate the risk of similar intrusions.