isometrix.com Listed by cactus Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized software and services firms, using double-extortion tactics that combine encryption with the public threat of data leaks. In this environment, listings on criminal leak sites have become a common way for attackers to pressure organisations and signal that internal material may already have left the network.

On 2 June 2024, the ransomware group known as cactus listed isometrix.com on its leak site, claiming to have exfiltrated internal files. The number of people affected remains unknown, and independent confirmation of the full scope is limited. What is public is the group’s assertion that personal, financial and corporate material was taken during a ransomware attack.

Inside the incident

Public reporting states that isometrix.com was listed by the cactus ransomware group on 2 June 2024. The listing describes the incident as a ransomware attack in which internal files were allegedly exfiltrated. The group published onion-site download links labelled as proof material and supplied a short data description. No independent verification of the volume of data, the precise date of intrusion, or the technical method of entry has been released in the available record. The number of individuals whose information may have been involved is listed as unknown.

Because the only detailed claims originate from the threat actor’s own site, the incident should be treated as an unverified listing rather than a fully confirmed breach disclosure from the organisation itself. Timing beyond the 2 June 2024 report date, exact scale, and forensic details remain undisclosed.

The group behind it: cactus

Cactus is a ransomware operation that has been active in the public threat landscape for several years. Like many contemporary groups, it typically employs a double-extortion model: systems are encrypted and a copy of stolen data is held for leverage. Victims are then listed on a dedicated leak site, often accompanied by sample files or directory listings, to increase pressure for payment. The group has previously targeted organisations across multiple sectors, using custom tooling and, in some cases, living-off-the-land techniques to move laterally once inside a network.

In this instance the group claims that isometrix.com data was taken and has posted purported proof links. Those claims have not been independently corroborated in the material available for this report; they remain assertions made by the actors themselves.

About isometrix.com

IsoMetrix is a software company that develops integrated management systems focused on environmental, health, safety, risk and sustainability performance. Organisations in mining, manufacturing, energy and other regulated industries commonly use such platforms to track compliance obligations, incident reporting, audits and related corporate records. Because the software often sits at the centre of operational and regulatory workflows, the systems and supporting corporate infrastructure can hold both customer-related information and internal business data.

A breach affecting a provider in this sector is consequential for two reasons. First, the company itself may store employee, executive and financial records. Second, customers who rely on the platform may have shared contractual, operational or personal data that could be exposed if the vendor’s environment is compromised. Even when the exact contents of a leak remain unconfirmed, the potential reach extends beyond a single organisation’s own staff.

What data was at risk

The cactus listing describes the material as “internal files exfiltrated in ransomware attack” and supplies the following data descriptions: personal identifiable information, employees and executives personal files, financial data, customer information, contracts and NDAs, corporate correspondence, and software development data. These categories are presented as the group’s own characterisation of the stolen set.

No independent inventory or confirmation of the precise files has been published. Organisations of this type typically maintain employee records, customer contracts, financial documentation and source-code or configuration material related to their products. Whether every category listed by the actors was in fact present, complete or usable cannot be verified from the public record. The exact contents therefore remain unconfirmed beyond the group’s claims.

The real-world impact

For individuals whose personal or employment data may have been included, the practical risks include phishing attempts that reference real internal details, identity-related fraud, and unwanted contact that exploits knowledge of job titles or corporate relationships. Financial data and contracts, if authentic, could be used for social-engineering attacks against the company or its clients. Software-development material, if present, might assist further technical reconnaissance, though no public evidence of secondary exploitation has been reported.

For the organisation, the listing creates reputational pressure, potential regulatory notification duties depending on jurisdiction, and the operational cost of investigation and remediation. Because the number of affected people is unknown and the data set is described only by the attackers, the full extent of harm cannot yet be quantified. The incident underscores the continuing exposure of mid-market software firms to ransomware groups that prioritise data theft alongside encryption.

If your data was in this claimed breach

If you have a past or present relationship with IsoMetrix—as an employee, contractor, customer contact or partner—treat the listing as a reason for heightened caution rather than confirmed personal exposure. Concrete first steps include:

• Monitor financial and credit accounts for unexpected activity and enable available fraud alerts.
• Change passwords on any accounts that reused credentials associated with work email or corporate systems, and enable multi-factor authentication where it is offered.
• Be sceptical of unsolicited messages that reference internal projects, contracts or colleagues; verify such contacts through known official channels.
• Review any personal documents or identity materials that may have been stored on company systems and consider placing freezes or alerts with relevant credit agencies if you are in a jurisdiction that offers them.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such checks do not prove or disprove involvement in this specific incident, but they provide a practical baseline for further monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.