CAS Software listed on sarcoma ransomware leak site

• Ransomware group: sarcoma
• Country: Germany
• Sector: Technology
• Announcement date: October 31, 2024

The German-based CRM solutions provider CAS Software has been listed on the leak site of the ransomware group known as sarcoma. On October 31, 2024, the threat actor published an announcement claiming to have obtained data belonging to the organization. The group alleges that this information was acquired directly from the systems of CAS Software and has subsequently been listed on their dedicated leak site.

The claims made by sarcoma

According to the announcement made by the sarcoma group, the organization's systems were compromised, leading to the alleged acquisition of sensitive data. While the group has claimed responsibility for the attack and the subsequent listing of the company on their platform, public information regarding the specific identity and operational details of this group remains limited. The threat actor's announcement serves as a public claim of a successful breach, though the details surrounding the initial access method have not been provided.

In many modern ransomware campaigns, threat actors utilize leak sites to exert pressure on victims. These sites act as a public bulletin board where stolen data is showcased to increase the likelihood of a ransom payment. Such tactics are often part of a broader strategy designed to damage a company's reputation and force compliance through public exposure.

Data allegedly involved in the breach

The information released by the sarcoma group suggests that the breach involves specific types of corporate data. While no screenshots were provided to verify the contents of the alleged theft, the group stated that the leaked data includes several critical components of the organization's digital infrastructure. The specific items mentioned in the claim are:

• SQL database files
• Exchange email contents

The presence of database files and email archives suggests that the attackers may have targeted core business information and internal communications. When such data is exfiltrated, it can provide attackers with a wealth of information regarding business processes, client interactions, and internal organizational structures.

About CAS Software

CAS Software AG is a leading German software company that specializes in providing customer relationship management (CRM) solutions. Specifically, the company focuses on serving small and medium-sized enterprises (SMEs). Founded in 1986, the organization has established itself as a provider of innovative CRM solutions and operates its business through an extensive network of partners.

Potential implications and industry risks

The alleged data leak poses significant privacy risks for both the customers and the employees of CAS Software. The contents of the claimed email communications and database files could potentially be utilized by malicious actors for identity theft or for conducting highly targeted phishing attacks. Because the organization is based in Germany, this incident may trigger formal legal processes under the General Data Protection Regulation (GDPR), which governs data privacy and protection within the European Union.

Furthermore, given the sensitive nature of CRM data, which often contains detailed information about client relationships and business leads, there is an increased risk regarding third-party supply chain vulnerabilities. When a software provider is compromised, the data of their clients may also be at risk, creating a ripple effect throughout the supply chain. Organizations in the technology and software services sector often face these heightened risks due to the volume of sensitive client information they manage.

If the sarcoma group is employing a double-extortion strategy, additional attempts to exert pressure on the organization could be observed. Double extortion is a common ransomware tactic where attackers not only encrypt the victim's data but also steal it, threatening to release it publicly unless a ransom is paid. This method increases the leverage held by the threat actor, as the victim faces both operational downtime and the threat of a public data breach. To defend against such threats, organizations typically implement robust backup strategies, continuous monitoring, and strict access controls to mitigate the impact of unauthorized data exfiltration.