Boart & Wire listed on sarcoma ransomware leak site

• Ransomware group: sarcoma
• Country: Italy
• Sector: Manufacturing
• Announcement date: January 14, 2025

Manufacturing company Boart & Wire targeted by sarcoma ransomware group

The Italian-based manufacturing firm Boart & Wire has been listed on the leak site associated with the sarcoma ransomware group. According to an announcement made on January 14, 2025, the threat actor group claims to have successfully compromised the organization's systems and exfiltrated sensitive information.

The claims made by sarcoma

The threat actor known as sarcoma published a leak announcement on January 14, 2025, claiming to have compromised data belonging to Boart & Wire. This announcement was made as part of the group's ongoing ransomware operations, where they utilize the threat of publishing stolen information to exert pressure on their victims. While the group has made this public claim, information regarding the specific identity and background of the sarcoma group remains limited in the public domain.

The group's modus operandi often involves this form of pressure, where the threat of exposing data is used as a primary tactic. Such tactics are common in modern ransomware attacks, often referred to as double extortion, where attackers not only encrypt a victim's files but also steal data to use as leverage during negotiations.

Affected data types

The announcement made by the sarcoma group claims that a 17 GB archive has been exfiltrated from the organization. While the group has not provided screenshots to verify the contents of this archive, they have specified the types of data they claim to have obtained. The reported data includes:

• File data
• SQL database records

Because no visual evidence or screenshots were provided with the leak site post, the specific details and authenticity of the contents within the 17 GB archive cannot be verified at this time.

About Boart & Wire

Boart & Wire is an Italy-based company that manufactures and markets diamond wires, discs, and blades for the stone industry. Established in 2005, the firm operates with production facilities and sales offices worldwide.

Analysis and potential implications

This alleged breach may pose risks to employee information, trade secrets, and customer data within Boart & Wire. The presence of data in SQL format suggests that sensitive corporate information may have been exfiltrated in a structured manner, which can be particularly damaging for an organization's operations.

As the institution is based in Italy, a confirmed breach could lead to legal sanctions and notification obligations under the General Data Protection Regulation (GDPR). Furthermore, the nature of the stolen data could increase secondary phishing risks for the institution's supply chain partners, as attackers often use stolen corporate data to craft highly convincing social engineering campaigns against related businesses.

Following a potential data exposure of this nature, organizations typically need to take precautions against identity theft and corporate espionage. In the manufacturing sector, protecting intellectual property and trade secrets is critical to maintaining a competitive advantage. Organizations facing such threats generally focus on enhancing their monitoring capabilities, implementing strict access controls, and ensuring robust backup strategies are in place to mitigate the impact of both data exfiltration and encryption-based attacks.

General defensive considerations

When organizations face threats from groups like sarcoma, the focus often shifts to incident response and damage control. This includes verifying the integrity of backups, auditing database access logs to determine the extent of the breach, and preparing for potential regulatory inquiries. Because the threat actor's primary method involves the threat of publication, maintaining a high level of vigilance against phishing and unauthorized access attempts is a standard defensive necessity for companies operating in global markets.