B&J Rocket Sales listed on sarcoma ransomware leak site

• Ransomware group: sarcoma
• Country: Switzerland
• Sector: Manufacturing
• Announcement date: November 19, 2025

B&J Rocket Sales targeted by sarcoma ransomware group

The threat actor known as sarcoma has officially listed the Swiss-based organization B&J Rocket Sales on its dedicated leak site. According to the announcement made on November 19, 2025, the group claims to have successfully executed a ransomware attack against the company. The threat actor asserts that they have obtained a significant volume of data from the organization's networks, specifically claiming to hold an archive totaling 156 GB.

The announcement of this breach occurred on the same day the group claims the attack took place. While the group has published this information on their leak site, public information regarding the specific identity, tactics, or background of the sarcoma group remains limited. This incident follows a common pattern in modern cybercrime where threat actors use leak sites to pressure victims by threatening to release sensitive information if demands are not met.

Details of the alleged data breach

The sarcoma group claims that the stolen information is contained within a large archive. Although no screenshots were provided by the group to verify the contents of the breach, the announcement specifies the types of data that have allegedly been compromised. The data is said to include various sensitive components that could impact the organization's internal operations and communications.

The specific types of data claimed to be involved in this breach include:

• File data
• SQL database records
• Exchange server data

The inclusion of Exchange server data is particularly significant in such incidents, as it often contains internal communications and sensitive information that can be exploited for further attacks. The presence of SQL databases suggests that structured organizational data may be at risk of exposure.

About B&J Rocket Sales

B&J Rocket Sales is a manufacturer based in Switzerland. The company specializes in the production of blades and carbide tools designed for the tire retreading industry. In addition to its work for the tire sector, the organization develops specialized cutting tools intended for use with various materials, including mineral wool, marble, and leather.

Potential impact and security implications

The alleged data breach poses several significant risks to B&J Rocket Sales. The exposure of such data may threaten the organization's operational continuity and could lead to the loss of valuable trade secrets. Furthermore, the potential disclosure of Exchange server data could result in the exposure of internal communications and sensitive customer information, which can be used to facilitate targeted phishing attacks against the organization's customers and supply chain partners.

Because the organization is based in Switzerland, this incident may lead to legal consequences under the Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR). Such incidents often necessitate a comprehensive reassessment of an organization's data security protocols to prevent future occurrences.

This incident highlights the use of double extortion tactics, a method where attackers not only encrypt an organization's systems but also steal data to use as leverage. To defend against such threats, organizations in the manufacturing sector often implement robust security measures. These typically include maintaining offline backups, enforcing multi-factor authentication, and conducting regular security audits. Organizations must also remain vigilant against social engineering and phishing attempts that often follow a data leak, as attackers may use stolen information to gain further access or target the victim's business partners.