A multinational energy management corporation serving over 2,000 global customers fell victim to a Cactus ransomware attack in January 2024. Threat actors exploited a VPN vulnerability to gain initial access, exfiltrating 1.5TB of sensitive data, including scanned passports of American citizens and non-disclosure agreements. Attackers leaked 25MB of stolen data as proof, though the full scope of compromised customer records remains undisclosed. The attack disrupted operations, with financial and reputational damage likely severe given the company’s role in critical energy infrastructure. The total cost—including ransom payments (if made), incident response, regulatory fines, and customer churn—has not been publicly quantified but aligns with the $10.22M average U.S. breach cost (2025). The incident underscores the escalating risk of supply chain-targeted ransomware, where third-party vulnerabilities enable cascading disruptions across interconnected ecosystems.