EARTHWORKS Group data allegedly leaked by sarcoma ransomware group

• Ransomware group: sarcoma
• Country: United States
• Sector: Professional Services
• Announcement date: October 9, 2024

A data breach claim against EARTHWORKS Group

The threat actor known as sarcoma has posted an announcement on its leak site claiming that it has successfully exfiltrated data belonging to EARTHWORKS Group. The announcement, which was published on October 9, 2024, alleges that the organization has been targeted in a cyberattack. While the group has listed the data on its platform, the specific details regarding the group's identity and operations remain limited in the public domain.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. In many modern cyberattacks, threat actors employ a tactic known as double extortion. In this scenario, the attackers do not just encrypt a victim's systems to disrupt operations; they also steal sensitive information before the encryption occurs. The threat of leaking this stolen data on a public forum serves as additional leverage to force the organization into compliance with ransom demands.

Details of the alleged leak

According to the claim made by the sarcoma group, the stolen data consists of a 15.5 GB archive. The announcement indicates that the breach occurred on the same day it was reported, October 9, 2024. The group has not provided any screenshots to verify the contents of the stolen archive, and no information regarding a ransom demand has been made public.

The leaked information is stated to be contained within the following formats:

• File data
• SQL database records

The presence of SQL database records suggests that the attackers may have accessed structured data, which often contains critical organizational information, client details, or internal records. The inclusion of general file data implies that a broader range of documents may have been compromised during the intrusion.

About EARTHWORKS Group

EARTHWORKS Group is an established firm that has been operating since 1996. Based in the United States, the company provides a wide array of turn-key planning and design services. Their expertise spans several technical fields, including engineering, architectural design, environmental management, land planning, and construction management.

The firm serves both public and private sector clients, offering specialized consulting services. Their work is integral to infrastructure development, structural design, and ensuring compliance with various regulatory requirements. Because of their involvement in large-scale engineering and environmental projects, the firm maintains significant technical and professional data related to its various service offerings.

Potential risks and organizational implications

The alleged exposure of 15.5 GB of data presents several significant risks to EARTHWORKS Group. Given the nature of the firm's work, the leaked data may contain highly sensitive information regarding engineering and environmental management projects. Such a breach could lead to the infringement of intellectual property rights and result in a substantial loss of commercial reputation.

Furthermore, the exposure of corporate data can create secondary risks for the organization's broader ecosystem. This includes potential identity theft or highly targeted phishing attacks directed at the firm's clients and supply chain partners. Because the organization is a US-based entity, such a breach may trigger investigations under various state-level privacy laws and oversight by regulatory bodies.

For organizations operating in the professional services sector, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive strategies include implementing strict access controls, maintaining regular offline backups, and employing continuous monitoring to detect unauthorized data exfiltration. As threat actors increasingly use double extortion to maximize their leverage, the protection of sensitive data through encryption and data loss prevention tools has become a critical component of modern enterprise security management.