regulvar.com Listed by cactus Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure mid-sized commercial firms by combining encryption with public data-leak threats, a pattern that has become routine across construction, manufacturing and building-services sectors. In this environment, a listing on a criminal leak site can signal either a completed intrusion or an attempt to force payment before any files are released.

On 16 February 2025 the ransomware group known as cactus listed regulvar.com, stating that internal files had been exfiltrated. The number of people affected remains unknown, and independent confirmation of the claimed theft has not been published. The listing itself is therefore treated as an unverified claim by the group.

Inside the incident

Public reporting on 16 February 2025 recorded that cactus had added regulvar.com to its leak site. The group asserted that internal files had been taken during a ransomware attack. No further technical details—such as the initial access method, the date of intrusion, the volume of data, or any ransom demand—have been disclosed in the available record. The number of individuals potentially affected is listed as unknown. At the time of reporting, no independent verification that files were actually stolen or that systems were encrypted has been released by the organisation or by third-party investigators.

Inside cactus

Cactus is a ransomware operation that became publicly visible in 2023. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also copying data and threatening to publish it if payment is not made. The group has been observed targeting organisations across multiple sectors and geographies, often using custom tooling and living-off-the-land techniques to maintain persistence. Its leak site serves as both a pressure mechanism and a public catalogue of claimed victims. In the present case, cactus claims to have exfiltrated internal files from regulvar.com; that claim has not been independently corroborated in the material available.

Who is regulvar.com?

Regulvar.com is the online presence of a Canadian firm based at 3985 Boulevard Industriel, Laval, Quebec. Publicly available information characterises its activities as commercial and residential construction-related services, with reported revenue of approximately $253.5 million. Companies of this type commonly manage project documentation, supplier contracts, employee records, client contact details and operational data tied to building systems and installations. A breach involving such an organisation can therefore affect both internal staff and external business partners who rely on the firm for construction and building-services work.

The information in question

The only data category named in the available record is “internal files exfiltrated in a ransomware attack.” No inventory of specific file types, databases or personal-data categories has been published. Organisations operating in commercial and residential construction typically hold project plans, financial records, employee information, client correspondence and supplier contracts. Because the exact contents remain undisclosed, it is not possible to confirm which of these categories, if any, were among the files the group claims to possess.

What's at stake

If internal files were in fact taken, individuals whose personal or professional details appear in those files could face risks of phishing, identity misuse or targeted social-engineering attempts. Business partners might see proprietary project information or commercial terms exposed, potentially affecting competitive position or contractual relationships. For the organisation itself, the incident raises questions of operational continuity, regulatory notification obligations under Canadian privacy law, and the cost of investigation and remediation. Until the scope of any actual data loss is clarified, these risks remain potential rather than confirmed.

Were you affected?

If you have worked with or for regulvar.com, monitor financial and email accounts for unusual activity and treat unsolicited messages that reference the company with caution. Change passwords on any accounts that may have been reused in a work context, and enable multi-factor authentication where available. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official statements from the organisation, if issued, should be followed for any further recommended steps.

AICompiled with AI assistance from public sources and published under our editorial standards.