ssmcoop.com targeted by Cactus ransomware group

• Ransomware group: Cactus
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: February 17, 2025

Cactus ransomware group claims data breach at ssmcoop.com

The Cactus ransomware group has officially listed ssmcoop.com on its leak site, announcing a significant data breach. According to the threat actor's claims, the group has exfiltrated approximately 26 GB of data belonging to the organization. This announcement marks a new instance of the group targeting specific entities to exert pressure through the exposure of sensitive information.

Details of the claimed attack

The threat actor claims to have gained unauthorized access to the organization's network on February 5, 2025. Following this initial access, the group announced the data leak on their dedicated leak site on February 17, 2025. The group alleges that the stolen information includes a variety of sensitive files, specifically targeting corporate documents and various employee-related files.

Ransomware leak sites are platforms used by cybercriminal groups to host stolen data and demand payment from victims. These sites serve as a public pressure mechanism. The Cactus group is known for employing double-extortion tactics. In a double-extortion scheme, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data. If the victim refuses to pay the ransom to restore their systems, the attackers threaten to publish the stolen information on these public leak sites to cause reputational, legal, or financial damage.

Data types and samples identified in the leak

The samples provided by the group in the leak include several types of sensitive documentation. The information allegedly stolen encompasses a wide range of internal and personal records. The specific items identified in the leak include:

• Corporate documents
• Contracts/agreements
• Production data
• Corporate correspondence
• Financial documents
• Employee personal files
• Tax forms

The specific contents of the leaked samples include corporate meeting minutes, W-9 tax forms, production calculation spreadsheets, income statements, and 1099-SA health savings account forms. No information was provided regarding the specific file count or the exact ransom demand.

About ssmcoop.com

All West Select Sires is a cooperative that provides bovine genetics and related services. The company offers livestock solutions such as artificial insemination, mating services, and genetic advancement programs.

Analysis and potential impact

The exposure of this data carries significant implications for the organization. Given that the organization is based in the United States, the exposure of employee data and financial information may lead to legal liabilities under relevant state laws and federal regulations. The disclosure of personal employee information could increase the risk of targeted phishing attacks and identity theft, as attackers often use personal details to craft more convincing social engineering campaigns.

Furthermore, the publication of corporate financial documents may allow competitors to access trade secrets and strategic plans, potentially damaging the organization's competitive standing in the agriculture and food production sector. The nature of the data, which includes production calculations and financial statements, highlights the sensitivity of the information held by such cooperatives.

Considering the group's known method of exploiting VPN vulnerabilities, the organization may need to conduct a thorough review of its security infrastructure. For organizations in similar sectors, maintaining robust security postures often involves implementing multi-factor authentication, conducting regular vulnerability assessments, and ensuring that remote access solutions like VPNs are strictly patched and monitored. Strengthening defenses against initial access vectors is a critical component of modern cybersecurity strategies to prevent the exfiltration of sensitive corporate and personal data.