FKS Group targeted by sarcoma in alleged data breach

• Ransomware group: sarcoma
• Country: Indonesia
• Sector: Agriculture and Food Production
• Announcement date: April 8, 2025

A data leak claim has been published against FKS Group by a threat actor group known as sarcoma. The announcement, which appeared on the group's leak site, alleges that the organization has been compromised and that a significant volume of data has been exfiltrated by the attackers.

The alleged incident

The threat actor group sarcoma has listed FKS Group on its dedicated leak site, claiming to possess data belonging to the organization. According to the notification posted on April 8, 2025, the attackers claim to have successfully compromised the target. The announcement specifically alleges that an archive file totaling 177 GB has been taken during the operation.

In many modern ransomware campaigns, threat actors employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also focus on exfiltrating sensitive information. The goal is to use the threat of leaking this data on a public leak site to pressure the victim into paying a ransom. If the ransom is not met, the stolen data is released to the public, causing reputational, legal, and operational damage.

Details of the claimed data

Regarding the specific contents of the breach, the announcement mentions an archive file of 177 GB. However, the threat actor has not provided a detailed file list or any sample data to verify the claim. Furthermore, no screenshots were included in the leak site notification to substantiate the theft.

• No specific data types were named in the listing.

Organization profile

FKS Group is a South-East Asian holding company that maintains a broad operational footprint. The company operates across several critical sectors, including food, infrastructure, and property. Through its various subsidiaries, FKS Group manages significant interests in agriculture, sugar refineries, logistics, and infrastructure development.

Risk assessment and implications

This incident may present a risk of exposure for operational and corporate data within FKS Group. Depending on the nature of the alleged data, negative impacts on employee personal information or trade secrets could be observed. The publication of such data may create secondary attack risks for the organization's supply chain partners and stakeholders, as attackers often leverage stolen corporate information to target connected entities.

The group responsible for this claim, sarcoma, has limited publicly available information regarding its identity or specific methods. In accordance with the data protection regulations in the regions where the organization operates, this situation may lead to the triggering of legal and administrative processes. Organizations facing such threats often prioritize incident response protocols, which include isolating affected systems, conducting forensic investigations, and notifying regulatory bodies as required by law.

For organizations operating in complex sectors like agriculture and logistics, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to prevent initial access via phishing or other social engineering vectors. As the investigation into this claim continues, the potential for secondary impacts on the broader supply chain remains a significant concern for stakeholders.