sarcoma
First seen October 9, 2024Active142 claimed victims
The claims below are reproduced as posted by sarcoma on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Sarcoma is a ransomware group that debuted in October 2024, immediately ranking among the top three most active groups globally and surpassing 116 documented victims by mid-2025, targeting mid-market companies across manufacturing, retail, healthcare, legal, and business services with roughly 50% of victims in the United States.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| ADT Freight Services Australia Pty Lt | November 14, 2024 | ransomware_live | — |
| CAS Software | October 31, 2024 | ransomware_live | — |
| TDM Technical Services | October 31, 2024 | ransomware_live | — |
| Brancaia | October 31, 2024 | ransomware_live | — |
| MESHWORKS | October 25, 2024 | ransomware_live | — |
| SRS-Stahl GmbH | October 25, 2024 | ransomware_live | — |
| Open Range Field Services | October 19, 2024 | ransomware_live | — |
| Zierick Manufacturing Corporation | October 19, 2024 | ransomware_live | — |
| Pheim Unit Trusts Berhad | October 19, 2024 | ransomware_live | — |
| Auxit S.r.l | October 17, 2024 | ransomware_live | — |
| McMunn & Yates Building Suppliesorp | October 15, 2024 | ransomware_live | — |
| Timber | October 13, 2024 | ransomware_live | — |
| Suntrust Properties | October 9, 2024 | ransomware_live | — |
| March Elevator | October 9, 2024 | ransomware_live | — |
| Elevator One | October 9, 2024 | ransomware_live | — |
| The Plastic Bag | October 9, 2024 | ransomware_live | — |
| Costa Del Sol Hotels | October 9, 2024 | ransomware_live | — |
| Navarra & Marzano | October 9, 2024 | ransomware_live | — |
| Jumbo Electronics Qatar | October 9, 2024 | ransomware_live | — |
| EasyPay | October 9, 2024 | ransomware_live | — |
| Curtidos Barbero | October 9, 2024 | ransomware_live | — |
| Lácteos Lorán | October 9, 2024 | ransomware_live | — |
| Road Distribution Services | October 9, 2024 | ransomware_live | — |
| Advanced Accounting & Business Advisory | October 9, 2024 | ransomware_live | — |
| Perfection Fresh | October 9, 2024 | ransomware_live | — |
| EARTHWORKS Group | October 9, 2024 | ransomware_live | — |
| Gedco | October 9, 2024 | ransomware_live | — |
| Antenne Reunion Radio | October 9, 2024 | ransomware_live | — |
| InCare Technologies | October 9, 2024 | ransomware_live | — |
| Ciclo Cairu | October 9, 2024 | ransomware_live | — |
| Rio Marine | September 17, 2024 | ransomware_live | — |
| The Roberts Family Law Firm | August 31, 2024 | ransomware_live | — |
| Smart Media Group Bulgaria | August 31, 2024 | ransomware_live | — |
| Gmg Mining Supplies | August 24, 2024 | ransomware_live | — |
| AHI Supply | August 11, 2024 | ransomware_live | — |
| Nora-Lindefrakt | August 6, 2024 | ransomware_live | — |
| Nexus-Shinozaki | August 6, 2024 | ransomware_live | — |
| Ferrer & Ojeda | July 27, 2024 | ransomware_live | — |
| Structure-flex | July 25, 2024 | ransomware_live | — |
| National Edging | July 9, 2024 | ransomware_live | — |
| Importadora Monterrey SRL | July 9, 2024 | ransomware_live | — |
| ICS Nett | July 9, 2024 | ransomware_live | — |
← NewerPage 2 of 2
Claim data from ransomware.live and RansomLook (CC BY 4.0).