Flo Components targeted by sarcoma ransomware group

• Ransomware group: sarcoma
• Country: Canada
• Sector: Manufacturing
• Announcement date: June 4, 2025

Data breach claim against Flo Components

The threat actor known as sarcoma has listed data belonging to Flo Components on their leak site. According to the announcement made on June 4, 2025, the group claims to have compromised an archive totaling 172 GB of data. This claim suggests a significant breach of information belonging to the Canadian organization.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also threaten to release sensitive information on public forums if a ransom is not paid. This tactic aims to exert maximum pressure on the victim by threatening their reputation and legal standing.

Details of the alleged incident

The threat actor claims to have obtained the stolen data following an incident that occurred on June 4, 2025. The announcement alleges that the compromised information includes files related to the company's operational processes. This type of data is often highly sensitive, as it can reveal how a company functions on a day-to-day basis.

While the group has posted the claim on their platform, the specific details regarding the nature of the breach remain limited. At this time, there is no information provided regarding a ransom demand, nor have any specific screenshots been released to verify the contents of the alleged theft. Consequently, the exact nature of the files within the archive cannot be determined with certainty.

Data involvement and contents

The leaked data is said to consist of a single archive file with a total size of 172 GB. Because no screenshots or specific file lists were provided by the threat actor, the specific contents of the archive remain unknown. The listing names no specific data types beyond the general mention of operational process files.

In many modern cyberattacks, the volume of data exfiltrated can vary significantly. Large archives, such as the 172 GB mentioned in this claim, can contain a wide array of corporate intelligence, ranging from administrative documents to technical specifications. However, without further evidence from the attacker, the exact composition of this archive remains a matter of the group's claim.

Organization profile: Flo Components

Flo Components is a Canada-based company specializing in automatic lubrication systems and fire suppression systems for heavy equipment since 1977. The company operates in the design, assembly, and installation of equipment reliability solutions, fluid management, and central automatic lubrication systems for industrial vehicles.

Risk assessment and implications

This incident may pose a risk to the company's trade secrets and operational data. Depending on the actual content of the leaked data, secondary risks for the company's supply chain partners and customers could emerge. If sensitive technical designs or client lists are indeed part of the 172 GB archive, the impact could extend beyond the immediate organization.

As the company operates in Canada, legal processes regarding data privacy obligations under PIPEDA may be triggered. Organizations facing such incidents often must navigate complex regulatory landscapes to ensure they meet their legal notification requirements to authorities and affected individuals.

For organizations operating in the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps include maintaining offline backups, implementing strict access controls, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors. Following a data breach, companies may need to notify affected parties and implement necessary security measures to mitigate further impact.