Elmos targeted by sarcoma ransomware group in alleged data breach

• Ransomware group: sarcoma
• Country: Germany
• Sector: Professional Services
• Announcement date: March 26, 2025

Elmos listed on sarcoma ransomware leak site

The professional services firm Elmos has been listed on the leak site of the ransomware group known as sarcoma. According to an announcement made by the threat actor, the organization has been targeted in a data breach involving a significant volume of information.

The claim made by the group suggests that a substantial amount of data has been compromised. Specifically, the threat actor alleges that they have exfiltrated 186 GB of data belonging to the organization. This type of activity is characteristic of modern ransomware operations, where attackers often employ double extortion tactics. In these scenarios, threat actors do not merely encrypt a victim's systems but also steal sensitive information to use as leverage, threatening to publish the data on public leak sites if their demands are not met.

Details of the alleged attack

The threat actor known as sarcoma published a post on March 26, 2025, claiming to have compromised data belonging to Elmos. The group alleges that they have exfiltrated data related to the company's IT and professional services operations. While the claim has been made public on a leak site, it is important to note that public information regarding this specific group remains limited.

The announcement indicates that the breach occurred on the same day the claim was published, March 26, 2025. However, as no screenshots or additional evidence were provided with the post, the specific content and authenticity of the stolen information cannot be verified at this time. The lack of visual proof is a common occurrence in ransomware announcements, making it difficult for external observers to confirm the validity of the claims immediately.

Alleged affected data types

According to the information provided in the group's post, the allegedly exfiltrated data includes the following:

• SQL database records
• File contents

About Elmos

Elmos is a Belgium-based IT and human resources consulting firm. The company provides specialized personnel staffing for IT projects and offers professional services. Given its role in providing specialized personnel and IT consulting, the organization operates within the professional services sector.

Potential impact and organizational risks

This alleged breach may pose secondary risks such as identity theft or fraud for the company's employees and customers. The fact that the data includes SQL records increases the possibility that sensitive corporate information or personal data may have been exposed. When databases are targeted, the risk to the organization is heightened because these files often contain structured, highly sensitive information that is critical to business operations.

Given that the company is based in Germany, the incident may need to be evaluated in terms of data breach notification and legal sanctions under GDPR. Regulations such as the General Data Protection Regulation (GDPR) impose strict requirements on how organizations must handle and report the exposure of personal data to protect the rights and freedoms of individuals.

The threat actor's intent to publish the data could damage the company's commercial reputation and jeopardize supply chain security. For companies in the professional services and IT consulting sectors, maintaining the trust of clients is paramount, and a breach can have cascading effects on the security of the entire supply chain. To mitigate such risks, it is often appropriate for an organization to initiate a forensic investigation to determine the full scope of the leaked data and to notify the relevant data protection authorities.

In general, organizations facing such threats should focus on robust incident response plans, continuous monitoring of their networks, and ensuring that sensitive databases are heavily protected with encryption and strict access controls. Strengthening defenses against unauthorized exfiltration is a critical component of modern cybersecurity posture.