Baker Tilly Morrison Murray listed on sarcoma leak site

• Ransomware group: sarcoma
• Country: South Africa
• Sector: Professional Services
• Announcement date: December 24, 2024

South African accounting firm targeted by sarcoma

The South Africa-based audit and accounting firm Baker Tilly Morrison Murray has been listed on the leak site of the threat actor known as sarcoma. The announcement, which appeared on December 24, 2024, indicates a significant data breach involving the professional services firm.

The threat actor, operating under the name sarcoma, claims to have successfully targeted the organization. According to the claims made on the leak site, the group has obtained a substantial volume of data belonging to the firm. This incident highlights the ongoing risks faced by professional service providers in the current cyber threat landscape.

Details of the alleged data theft

The sarcoma group claims to have exfiltrated 516 GB of data from Baker Tilly Morrison Murray. The announcement was made on the same day the attack was allegedly carried out, December 24, 2024. While the volume of data is specified, the threat actor has not provided a specific file count or a ransom demand in the public announcement.

The listing specifies the types of digital assets that have supposedly been compromised. The data allegedly stolen includes:

• Files
• SQL databases

It is important to note that because no screenshots were provided with the announcement, the specific content and nature of these files and databases cannot be verified at this time. In many ransomware scenarios, threat actors use double extortion tactics, where they not only encrypt an organization's systems but also steal sensitive data to threaten its public release if a ransom is not paid. This pressure is designed to force the victim into compliance by threatening reputational damage and regulatory scrutiny.

About Baker Tilly Morrison Murray

Baker Tilly Morrison Murray is an independent accounting firm based in Durban, South Africa. The firm provides a range of professional services, including auditing and business advisory services. As a member of the Baker Tilly International network, the organization offers specialized services within the local market, serving various clients through its professional expertise.

Implications and industry considerations

This incident suggests that sensitive data belonging to a firm operating in the professional services sector may have been compromised. The alleged theft of SQL databases is particularly concerning, as these databases could contain critical information regarding the firm's clients and its internal business operations. Such a breach may increase the risk of identity theft and financial fraud for the affected clients.

Furthermore, a breach of this nature could lead to significant challenges for the firm regarding compliance with data protection regulations in South Africa. Organizations in the professional services sector handle vast amounts of sensitive client information, making them high-value targets for cybercriminals. When a breach occurs, the potential for secondary impacts, such as loss of client trust and legal liabilities, is high.

While public information regarding the sarcoma group remains limited, the incident underscores the necessity for organizations to maintain robust cybersecurity postures. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security awareness training for employees. In the event of a confirmed breach, organizations typically need to notify their clients and initiate comprehensive forensic investigations to determine the full scope of the compromise and to mitigate further risks.