McAlvain Companies, Inc. Hit by Cactus Ransomware Attack: Implications and Response

Incident Date:

April 17, 2024

Overview

Title

McAlvain Companies, Inc. Hit by Cactus Ransomware Attack: Implications and Response

Victim

McAlvain Companies, Inc

Attacker

Cactus

Location

Boise, USA

Idaho, USA

First Reported

April 17, 2024

McAlvain Companies, Inc. Falls Victim to Cactus Ransomware Attack

Attack Overview

In April, 2024, McAlvain Companies, Inc., a prominent construction firm based in Idaho, confirmed a significant data breach. This breach was orchestrated by the ransomware group Cactus, which exploited the company's systems to access sensitive human resources information, including Social Security numbers, names, addresses, and dates of birth of its employees.

The company has initiated an incident response plan, involving third-party cybersecurity experts to mitigate the damage and investigate the breach's specifics

Company Profile

Established in 1980, McAlvain Companies has grown to become a significant player in the construction industry in the western United States. With headquarters in Boise, Idaho, the company boasts an annual revenue exceeding $2 billion and employs around 250 individuals. McAlvain is renowned for its construction management, general contracting, design-build, and concrete services, emphasizing safety, quality, productivity, and innovative leadership.

The firm's substantial scale and its extensive involvement in high-value construction projects make it a notable target for cybercriminals looking to exploit valuable corporate and employee data.

Profile of the Attacker: Cactus Ransomware

Cactus ransomware, which surfaced in March 2023, has quickly established itself as a formidable threat in the cyber landscape. Known for its double extortion tactic, the group not only encrypts the victim's data but also threatens to sell or leak the data unless a ransom is paid. This method has been employed in various attacks globally, targeting sectors like manufacturing and professional services.

The ransomware is particularly challenging to detect and mitigate due to its advanced encryption techniques and the use of legitimate tools to maintain persistence in the infected systems.

Implications for McAlvain Companies

The breach poses severe risks to the privacy of McAlvain's employees and places the company at risk of reputational damage and potential financial losses. While McAlvain has offered complimentary credit monitoring through Cyberscout to affected employees, the long-term implications of such a breach could affect the company's operational capabilities and client trust.

Sources

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.

LockBit Ransomware Hits TPG Aged Care Raising Data Security Concerns

Kingsley, Australia

, Australia

Industry

Healthcare Services

Victim