Hi-cone.com listed on Cactus ransomware leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Manufacturing
• Announcement date: January 12, 2024

Cactus ransomware group claims data breach at hi-cone.com

The Cactus ransomware group has officially listed hi-cone.com on its dedicated leak site, alleging that the organization has been targeted in a cyberattack. According to the announcement made by the threat actors, the group claims to have acquired corporate data belonging to the company. This type of public listing is a common tactic used by ransomware groups to pressure victims into paying ransoms through a method known as double extortion, where stolen data is threatened with public release.

The group's announcement, posted on January 12, 2024, suggests that the breach may have occurred much earlier than the public disclosure. Specifically, the attackers claim to have gained unauthorized access to the organization's networks as far back as December 18, 2023. The listing implies that the organization's data has been compromised and remains at risk of being published on the group's leak site.

Details of the alleged data theft

While the specific volume of the data has not been confirmed by the organization, the Cactus group's announcement points toward a significant breach. The group has provided screenshots intended to demonstrate the nature of the stolen information. These visual proofs indicate that the breach involves a combination of sensitive corporate documentation and highly personal identification files.

Based on the evidence provided by the attackers, the following types of data are reportedly included in the breach:

• Passport data
• Confidentiality agreements
• Technical schematics

The presence of such diverse data types—ranging from personal identification to proprietary technical designs—highlights the potential impact of the incident on both individual employees and the company's intellectual property.

About hi-cone.com

Hi-Cone is a global company that specializes in the manufacturing of plastic ring carriers and sustainable packaging solutions specifically designed for the beverage industry. The organization maintains a significant international presence and is headquartered in Chicago, United States.

Risk assessment and industry implications

The Cactus group is recognized in the threat intelligence community for its specific methodology, which frequently involves exploiting vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to corporate networks. Once inside, the group typically employs double extortion tactics, leveraging the threat of data leaks to increase their leverage over the victim.

The nature of the alleged leak poses several distinct risks. The inclusion of personal identification data, such as passports, presents a direct risk of identity theft for the individuals whose information was captured. Furthermore, because the organization is based in the United States, this incident may trigger legal consequences and regulatory scrutiny under various state laws and federal data protection regulations.

From a business continuity and supply chain perspective, the breach could create secondary risks. The stolen information may be used to launch targeted phishing campaigns against the organization's partners or supply chain collaborators. There is a significant possibility that the leaked data could be utilized in subsequent, secondary attacks against the company or its associates. To mitigate such risks, organizations in the manufacturing sector are often advised to focus on securing remote access points, implementing robust multi-factor authentication, and maintaining strict monitoring of network traffic to detect unauthorized access early.