EP:Schuller listed on sarcoma ransomware leak site

• Ransomware group: sarcoma
• Country: Austria
• Sector: Manufacturing
• Announcement date: November 30, 2024

EP:Schuller listed on sarcoma ransomware leak site

The Austrian manufacturing company EP:Schuller has been listed on the leak site of the ransomware group known as sarcoma. The threat actor claims to have successfully breached the organization's systems, marking a new instance of data exposure targeting the industrial sector.

The claims made by sarcoma

According to the announcement made on November 30, 2024, the sarcoma group alleges that they have obtained a significant amount of data from the systems of EP:Schuller. The threat actor claims that the attack took place on the same day the announcement was posted, November 30, 2024. While the group has published a notice regarding the breach, public information regarding the specific tactics, techniques, or procedures used by the sarcoma group remains limited in the public domain.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. This tactic is frequently associated with double extortion, where attackers not only encrypt an organization's data but also steal sensitive information to threaten its public release. By hosting a dedicated leak site, these groups create a sense of urgency and public pressure, aiming to damage the victim's reputation to compel payment.

Details regarding the claimed data

The sarcoma group has published a data archive that is claimed to belong to EP:Schuller. The size of this archive is reported to be 88 GB. Regarding the specific nature of the information contained within this archive, the announcement states that the data consists of files, but no detailed breakdown of the content has been provided. Furthermore, no screenshots were included in the leak site announcement to verify the contents of the stolen files.

The listing names no specific data types that have been compromised. In such scenarios, the lack of transparency from the threat actor makes it difficult for the victim and the public to understand the exact scope of the breach until a full investigation is conducted. The absence of a ransom demand in the public announcement also leaves the current status of negotiations or the group's specific intent for this particular victim unknown.

Organizational profile

EP:Schuller is an Austrian family-owned business that has been operating since 1989. The company specializes in energy systems and installation solutions. Their service portfolio is diverse, ranging from small-scale residential projects to the implementation of complex, large-scale industrial facilities.

Potential implications and defensive considerations

If the claims made by the sarcoma group are verified, the exposure of operational data and customer information may occur. Because the organization operates within Austria, it may be subject to data breach notification requirements and administrative sanctions under the General Data Protection Regulation (GDPR). Such regulations are designed to ensure that organizations protect personal data and notify authorities and affected individuals when a breach occurs.

The leaked data could potentially be utilized by third parties for malicious purposes, such as identity theft or targeted phishing attacks. In a phishing attack, the stolen information is used to craft highly convincing fraudulent communications to deceive employees or customers. Additionally, secondary risks may arise for the organization's supply chain partners, which could lead to a loss of corporate reputation for both the primary victim and its associates.

To mitigate such risks, organizations in the manufacturing and energy sectors often implement various defensive measures. These include robust access controls, regular security awareness training for employees, and comprehensive monitoring of network traffic to detect unauthorized access. Maintaining regular, offline backups and ensuring a well-tested incident response plan are also critical components of a modern cybersecurity posture. Protecting the supply chain is equally vital, as a breach in one organization can serve as a gateway to its business partners.