sarcoma
First seen October 9, 2024Active142 claimed victims
The claims below are reproduced as posted by sarcoma on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Sarcoma is a ransomware group that debuted in October 2024, immediately ranking among the top three most active groups globally and surpassing 116 documented victims by mid-2025, targeting mid-market companies across manufacturing, retail, healthcare, legal, and business services with roughly 50% of victims in the United States.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| victim | October 13, 2026 | ransomware_live | — |
| GYF | March 30, 2026 | ransomware_live | — |
| Propane Levac Inc. | January 23, 2026 | ransomware_live | — |
| MecMatica | January 20, 2026 | ransomware_live | — |
| Söllner | November 20, 2025 | ransomware_live | — |
| B&J Rocket Sales | November 19, 2025 | ransomware_live | — |
| Paul Hildebrandt | November 11, 2025 | ransomware_live | — |
| Unimed do Brasil | October 15, 2025 | ransomware_live | — |
| Charter Industrial Supply | October 8, 2025 | ransomware_live | — |
| MSB | September 29, 2025 | ransomware_live | — |
| MACMA Werbeartikel oHG | September 25, 2025 | ransomware_live | — |
| Thermofin | September 23, 2025 | ransomware_live | — |
| Miami Management | September 22, 2025 | ransomware_live | — |
| Pfullendorfer Tor-Systeme | September 17, 2025 | ransomware_live | — |
| Kwg | September 17, 2025 | ransomware_live | — |
| IAD GmbH | September 17, 2025 | ransomware_live | — |
| F1-Generation | September 16, 2025 | ransomware_live | — |
| Inox Laghi | August 27, 2025 | ransomware_live | — |
| Maselli Misure S.p.A. Information | August 15, 2025 | ransomware_live | — |
| Metro Heating | August 6, 2025 | ransomware_live | — |
| Harinera del Valle | August 6, 2025 | ransomware_live | — |
| Sanderling Healthcare | July 23, 2025 | ransomware_live | — |
| CARSTAR Business Group | July 14, 2025 | ransomware_live | — |
| Milberg | July 8, 2025 | ransomware_live | — |
| https://thesandersfirm.com/ | July 7, 2025 | ransomware_live | — |
| Sanderling | July 3, 2025 | ransomware_live | — |
| Cameron, Hodges, Coleman, LaPointe | July 1, 2025 | ransomware_live | — |
| Machu Picchu Foods | June 24, 2025 | ransomware_live | — |
| RADIX | June 19, 2025 | ransomware_live | — |
| gibGREINER | June 17, 2025 | ransomware_live | — |
| SecurU | June 15, 2025 | ransomware_live | — |
| JELGAVAS TIPOGRAFIJA | June 11, 2025 | ransomware_live | — |
| Western Insurance Marketing Corporation | June 5, 2025 | ransomware_live | — |
| PPM Industries SpA | June 4, 2025 | ransomware_live | — |
| Norgeshus | June 4, 2025 | ransomware_live | — |
| APH Svenska | June 4, 2025 | ransomware_live | — |
| RISE Racing | June 4, 2025 | ransomware_live | — |
| Buford Ranches | June 4, 2025 | ransomware_live | — |
| Strand Ag Supply | June 4, 2025 | ransomware_live | — |
| Miller & Stewart | June 4, 2025 | ransomware_live | — |
| Reece Noland & McElrath Engineers | June 4, 2025 | ransomware_live | — |
| Flo Components | June 4, 2025 | ransomware_live | — |
| DMG Contractors | June 4, 2025 | ransomware_live | — |
| Decoline | May 4, 2025 | ransomware_live | — |
| Defiance | May 4, 2025 | ransomware_live | — |
| NNC Firm | May 4, 2025 | ransomware_live | — |
| Lubiam | May 4, 2025 | ransomware_live | — |
| Sinalisa Segurança Viária Ltda | April 21, 2025 | ransomware_live | — |
| FAKO-M Getränke | April 20, 2025 | ransomware_live | — |
| Ju Percussion Group | April 17, 2025 | ransomware_live | — |
| Manchester Credit Union | April 17, 2025 | ransomware_live | — |
| Schultz Industries Inc. | April 17, 2025 | ransomware_live | — |
| TRALFO Srl Trasporti e Spedizioni | April 17, 2025 | ransomware_live | — |
| Kaye Lifestyle Homes | April 17, 2025 | ransomware_live | — |
| TMA Group of Companies | April 10, 2025 | ransomware_live | — |
| FKS Group | April 8, 2025 | ransomware_live | — |
| Gruppo C.R S.p.a | April 8, 2025 | ransomware_live | — |
| FUJIFILM | April 5, 2025 | ransomware_live | — |
| Apex Logistics International | April 5, 2025 | ransomware_live | — |
| Woodmen Valley Chapel | April 4, 2025 | ransomware_live | — |
| The ToolShed | April 4, 2025 | ransomware_live | — |
| Geass | March 29, 2025 | ransomware_live | — |
| Austring Fairman & Fekete | March 26, 2025 | ransomware_live | — |
| The PNST | March 26, 2025 | ransomware_live | — |
| Elmos | March 26, 2025 | ransomware_live | — |
| Benkin Sheet Metal 2008 Ltd | March 26, 2025 | ransomware_live | — |
| Initiative Var | March 26, 2025 | ransomware_live | — |
| Roshan Packages | March 26, 2025 | ransomware_live | — |
| R&K Drysdales | March 26, 2025 | ransomware_live | — |
| MESS sales srl | March 16, 2025 | ransomware_live | — |
| Aj Taylor Electrical Contractors Ltd | March 7, 2025 | ransomware_live | — |
| Unimicron | February 11, 2025 | ransomware_live | — |
| Wisper Reimer Ingenieure GmbH | February 11, 2025 | ransomware_live | — |
| ldi-trucking-inc | February 11, 2025 | ransomware_live | — |
| I.B.G SPA | February 11, 2025 | ransomware_live | — |
| Saied Music | February 10, 2025 | ransomware_live | — |
| Upstate Glass Tempering | February 10, 2025 | ransomware_live | — |
| Polstermöbel Oelsa GmbH | February 10, 2025 | ransomware_live | — |
| cana group corp | January 20, 2025 | ransomware_live | — |
| compass-underwriting-ltd | January 20, 2025 | ransomware_live | — |
| Jacquet Weston Engineering | January 20, 2025 | ransomware_live | — |
| JD Lighting | January 16, 2025 | ransomware_live | — |
| Dona Formosa | January 16, 2025 | ransomware_live | — |
| Boart & Wire | January 14, 2025 | ransomware_live | — |
| Sheyenne Tooling & Manufacturing | January 10, 2025 | ransomware_live | — |
| Michelle Accesorios | December 26, 2024 | ransomware_live | — |
| Supraterra | December 25, 2024 | ransomware_live | — |
| Kern Services | December 24, 2024 | ransomware_live | — |
| Baker Tilly Morrison Murray | December 24, 2024 | ransomware_live | — |
| Brasilmad | December 12, 2024 | ransomware_live | — |
| Gulf Petrochemical Services & Trading | December 8, 2024 | ransomware_live | — |
| Pan Gulf Holding | December 6, 2024 | ransomware_live | — |
| Anonymous Victim | December 5, 2024 | ransomware_live | — |
| FF Steel | December 4, 2024 | ransomware_live | — |
| Chema Per | November 30, 2024 | ransomware_live | — |
| EP:Schuller | November 30, 2024 | ransomware_live | — |
| Kelowna Springs | November 14, 2024 | ransomware_live | — |
| Micon National | November 14, 2024 | ransomware_live | — |
| Popular Life Insurance | November 14, 2024 | ransomware_live | — |
| CP Construplan | November 14, 2024 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).