sunrise-soya.com Listed by cactus Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure mid-sized manufacturers and food producers by combining system encryption with data theft, then publicizing victims on leak sites when negotiations stall. In this environment, even specialized consumer brands can find themselves listed without prior public warning, leaving customers, employees and partners to assess risk from incomplete information.

On 21 January 2025, the domain sunrise-soya.com appeared on a listing attributed to the cactus ransomware group. Public reporting describes the incident as a ransomware attack in which internal files were allegedly exfiltrated. The number of people affected remains unknown, and further technical detail has not been disclosed.

What happened

According to the available record, sunrise-soya.com was listed by the cactus ransomware group on 21 January 2025. The listing characterises the event as a ransomware attack that involved the exfiltration of internal files. No confirmed count of affected individuals, no inventory of specific file types beyond the general description of “internal files,” and no timeline of initial intrusion or ransom demand have been made public. The organisation has not issued a detailed public statement confirming or denying the claim in the materials reviewed for this account. As with many leak-site postings, the listing itself constitutes an unverified claim by the threat actor until independently corroborated.

Inside cactus

Cactus is a ransomware operation that became active in 2023 and is known for double-extortion tactics: encrypting victim systems while simultaneously stealing data and threatening to publish it. The group typically gains access through compromised credentials or vulnerable remote-access services, deploys custom encryption tools, and maintains a dedicated leak site where it posts victim names and sample data if payment is not received. Prior public activity has focused on mid-market organisations across manufacturing, professional services and retail rather than exclusively on large enterprises. Cactus has not, in the materials available for this incident, released further statements or sample files specifically tied to sunrise-soya.com beyond the initial listing claim.

sunrise-soya.com and its sector

Sunrise Soya Foods, operating under sunrise-soya.com, is a Canadian manufacturer of tofu and soy-based products based in Vancouver, British Columbia. Public descriptions place the company in the grocery-retail and food-production sector; it has operated since 1956 and reports annual revenue of approximately $42.2 million. Organisations of this type typically manage supplier contracts, production formulas, employee records, distribution logistics and customer or wholesale account information. A ransomware incident affecting such a firm is consequential because food-supply chains rely on continuous operations and because any compromise of internal systems can disrupt manufacturing schedules, inventory tracking and regulatory compliance documentation. The precise operational impact on Sunrise Soya Foods remains undisclosed.

What data was at risk

The only data category named in the public record is “internal files” said to have been exfiltrated during the ransomware attack. No further breakdown—such as employee personally identifiable information, customer lists, financial records or proprietary recipes—has been confirmed. Food manufacturers commonly hold payroll data, supplier invoices, quality-control logs and wholesale customer details; any of these could theoretically have been present among internal files. Because the exact contents remain unconfirmed, it is not possible to state which specific categories were exposed. Affected parties should treat the claim of exfiltration as a signal to monitor for secondary misuse rather than as a verified inventory of lost data.

Why it matters

For individuals whose information may have been among the internal files, the practical risks include targeted phishing that references legitimate business relationships, identity-related fraud if personal details were present, and potential exposure of employment or contact data. For the organisation, the consequences can include temporary production interruptions, costs associated with system recovery, and reputational questions from retailers and consumers who rely on consistent supply of food products. Because the scale of the breach is unknown and the listing remains an actor claim, the full extent of these risks cannot yet be quantified. Calm monitoring and verification remain the proportionate response.

What to do if you're exposed

If you have a past or present relationship with Sunrise Soya Foods—as an employee, supplier or wholesale customer—begin by watching for unexpected emails or calls that reference the company or request urgent action. Change passwords on any accounts that may have shared credentials with work systems, and enable multi-factor authentication where available. Review financial and credit statements for unfamiliar activity. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach datasets; such a check provides an early indicator but does not confirm or rule out involvement in this specific incident. Continue to rely on official company communications for any verified updates rather than on unverified leak-site claims.

AICompiled with AI assistance from public sources and published under our editorial standards.