Steelerubber.com targeted by Cactus ransomware group

• Ransomware group: Cactus
• Country: United States
• Sector: Manufacturing
• Announcement date: February 17, 2025

The Cactus ransomware group has listed data on its leak site that it claims belongs to steelerubber.com. This announcement, made on February 17, 2025, follows a claimed attack date of February 5, 2025. The threat actor alleges to have compromised the organization's data, specifically targeting a portion of its operational and personal information.

The claimed attack and data exposure

The threat actor known as Cactus claims to have compromised data belonging to steelerubber.com and has listed it on their leak site. According to the group's claims, the breach involves the exposure of a portion of the organization's operational and personal data. The threat actor alleges to have gained access to the organization's financial and corporate documents.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. This tactic is frequently associated with double-extortion strategies, where attackers not only encrypt an organization's systems but also steal sensitive data, threatening to publish it publicly if the ransom is not met. This method aims to maximize leverage by threatening the victim's reputation and legal standing through the exposure of private information.

Data types involved in the alleged leak

The announcement claims to contain a wide variety of sensitive information. According to the group, the leaked content includes:

• Personally identifiable information
• Financial data
• Payroll information
• Employee HR data
• Engineering drawings
• Contracts

The threat actor has provided screenshots as evidence of the breach. These samples reportedly include W-4 forms, background check reports, and various technical drawing samples, indicating that the stolen data spans from highly sensitive personal employee records to proprietary technical information.

About steelerubber.com

Steele Rubber Products is an American manufacturer that has been producing weatherstripping and rubber parts for classic cars, trucks, and hot rods since the 1960s. The company supplies high-quality automotive replacement parts, including windshields, doors, windows, and various mechanical gaskets.

Analysis and potential impact

The alleged leak may pose secondary risks such as identity theft and targeted phishing attacks for the organization's employees and customers. The presence of W-4 forms and background reports in the provided samples suggests that sensitive personal information may have been exposed. Because the organization is based in the United States, the exposure of such data may trigger data privacy obligations under relevant state laws and federal regulations.

Given the Cactus group's known double-extortion tactics, the publication of this data could have negative impacts on the organization's commercial reputation and operational processes. The group is known to exploit VPN vulnerabilities to gain access to networks, suggesting that the organization's network security processes may need to be re-evaluated to prevent future unauthorized access.

For organizations in the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps include implementing multi-factor authentication, conducting regular vulnerability assessments, and securing remote access points like VPNs. Protecting intellectual property, such as engineering drawings, and sensitive HR data is critical for maintaining both operational integrity and the trust of employees and clients alike.