Dona Formosa listed on sarcoma ransomware leak site

• Ransomware group: sarcoma
• Country: Brazil
• Sector: Agriculture and Food Production
• Announcement date: January 16, 2025

A new victim in the dairy sector

The threat actor known as sarcoma has listed data allegedly belonging to Dona Formosa on its leak site. This announcement, which occurred on January 16, 2025, marks a new instance of a ransomware group targeting a specific organization to exert pressure through the threat of data exposure.

Ransomware attacks often involve a strategy known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The threat of leaking this stolen data on a public platform serves as a secondary lever to coerce the victim into paying a ransom. While the specific demands of the group in this instance remain unknown, the presence of an organization on a leak site is a significant indicator of a targeted cyberattack.

Details of the claim

According to the announcement made by the sarcoma group, the incident involves a data leak rather than a simple encryption event. The group claims that the breach resulted in the theft of a specific volume of information. While the group has publicized the existence of this data, they have not provided any screenshots or specific details regarding the nature of the files stolen during the intrusion.

Regarding the specific content of the breach, the following details have been provided by the threat actor:

• The leaked data is said to consist of a 4 GB archive.

The listing does not provide a detailed breakdown of the specific files or the exact types of data contained within this archive. Furthermore, no information has been provided regarding a ransom demand or the specific file count involved in the breach.

About Dona Formosa

Dona Formosa is a Brazilian food company that has been operating since 1999. The organization specializes in the production and distribution of dairy products. The company manages its manufacturing processes in Águas Formosas and maintains a distribution center located in Belo Horizonte. Through these facilities, the company supplies a wide range of customers, including restaurants, supermarkets, and individual consumers throughout the state of Minas Gerais.

Potential impact and risks

This incident indicates a potential risk of exposure for the organization's operational and commercial data. When a company's data is exfiltrated and threatened with release, it can lead to several critical consequences. If the leaked data contains sensitive information belonging to customers or employees, it may trigger legal processes under Brazil's LGPD (Lei Geral de Proteção de Dados). Such regulatory frameworks are designed to protect personal data and impose strict requirements on how organizations handle and secure information.

Beyond legal implications, there are significant operational and reputational risks. The exposed data could potentially be utilized by malicious actors to conduct targeted phishing attacks against the organization's supply chain partners. By leveraging stolen commercial or contact information, attackers can craft highly convincing messages to deceive partners and collaborators. Additionally, the organization may face reputational damage and disruptions in its commercial operations as a result of the breach.

In the agriculture and food production sector, maintaining the integrity of supply chain communications and protecting commercial data is vital for continuous operation. Organizations in this sector often prioritize defensive measures such as robust access controls, regular security audits, and employee training to mitigate the risk of data exfiltration. Public information regarding the sarcoma group remains limited, making it difficult to assess the full scope of their typical tactics and procedures.