Coop.se listed on Cactus ransomware leak site

• Ransomware group: Cactus
• Country: Sweden
• Sector: Retail & E-Commerce
• Announcement date: December 29, 2023

The Swedish retail chain coop.se has been listed on the leak site of the Cactus ransomware group. According to an announcement made by the group, the organization has been targeted in a cyberattack involving a significant amount of data.

The claims made by the Cactus ransomware group

The Cactus ransomware group published an announcement on December 29, 2023, claiming to have compromised data belonging to coop.se. According to the group's claims, access to the organization's network was obtained on December 21, 2023. While the group has published an announcement regarding the breach, no information was given regarding a specific ransom demand.

The group appears to be employing double extortion tactics. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish stolen data on public leak sites, the attackers aim to increase the pressure on the victim organization to fulfill ransom demands, using the threat of reputational damage and regulatory scrutiny as primary motivators.

Data allegedly involved in the breach

The group has provided screenshots that purportedly contain samples of both personal and commercial data. The information allegedly stolen includes sensitive documentation that could impact various stakeholders within the organization's ecosystem.

The data types mentioned in the leak include:

• Passport data
• Driver's license information
• Corporate reports

The screenshots provided by the group allegedly show Swedish passports, driver's licenses, and corporate economic forecast reports. The presence of such sensitive identification documents suggests a high level of data exposure.

About coop.se

Coop is a major Swedish consumer cooperative chain. Operating numerous grocery stores and supermarkets across the country, the company is active in the retail sector for food and daily consumer goods.

Analysis and implications for the retail sector

The allegedly leaked data may pose a risk of identity theft for the organization's employees or customers. Given the nature of the documents shown in the screenshots, such as passports and driver's licenses, the potential for fraudulent activity is significant. Furthermore, as the organization operates in Sweden, it may face administrative sanctions due to data protection obligations under the GDPR.

The Cactus group is known to exploit VPN vulnerabilities to gain initial access to networks. This highlights a critical area for organizational defense; maintaining robust network security processes and ensuring that remote access solutions are patched and secured is a vital defensive step for companies in this sector. The sensitivity of the disclosed documents, particularly economic forecast reports, could lead to reputational damage and a loss of customer trust.

For organizations in the retail and e-commerce sectors, this incident underscores the importance of comprehensive data protection strategies. The double extortion method used by groups like Cactus increases the pressure on organizations through the constant threat of publishing sensitive data. To mitigate these risks, organizations often focus on implementing strict access controls, monitoring for unauthorized network activity, and ensuring that all perimeter devices are regularly updated to prevent exploitation of known vulnerabilities.