IAD GmbH listed on sarcoma ransomware leak site

• Ransomware group: sarcoma
• Country: Germany
• Sector: Education
• Announcement date: September 17, 2025

The sarcoma ransomware group claims IAD GmbH data breach

The educational institution IAD GmbH has been listed on a leak site by the sarcoma ransomware group. According to the announcement made on September 17, 2025, the group claims to have compromised data related to the institution's training and certification services. The group states that an archive totaling 43 GB has been leaked.

Information regarding the sarcoma group remains limited in the public domain. Ransomware groups often utilize leak sites to host stolen data as a form of double extortion. In such scenarios, attackers not only encrypt an organization's internal systems but also threaten to publish sensitive information to pressure the victim into paying a ransom. While the group has posted this claim, no screenshots were provided to substantiate the contents of the alleged leak.

Details of the alleged data leak

The information provided on the leak site suggests that the stolen data is substantial in volume. The group claims that the compromised information includes several types of critical digital assets. The specific types of data mentioned in the claim include:

• File data
• SQL database records
• Exchange server data

The disclosure of such diverse data types, ranging from raw files to database records and email server contents, represents a significant breach of digital assets. When attackers target SQL databases and email servers, they often aim to acquire structured information and historical communications, which can be used for various malicious purposes.

About IAD GmbH

IAD GmbH is a Germany-based training and certification organization. The company operates Pearson VUE test centers, provides corporate training, and offers consulting and recruitment services.

Potential risks and implications of the breach

This alleged data leak may pose secondary risks such as identity theft or targeted phishing attacks for the institution's employees and students. The nature of the alleged data suggests that sensitive information regarding the institution's certification processes may also have been exposed. Furthermore, the disclosure of database and email server contents may compromise the institution's operational security and trade secrets.

Since the institution operates in Germany, the exposure of personal data could lead to legal sanctions and notification requirements under the GDPR. Regulatory frameworks like the General Data Protection Regulation (GDPR) require organizations to implement strict technical and organizational measures to protect personal data and mandate specific protocols if a breach occurs. The potential exposure of sensitive certification data adds a layer of complexity to the institution's security posture and reputation.

In general, organizations in the education and certification sector can take several defensive steps to mitigate the impact of such threats. Implementing robust multi-factor authentication (MFA) across all services, particularly for email and database access, is a fundamental security practice. Regular, offline backups of critical data, including SQL databases and server configurations, can help ensure business continuity. Additionally, monitoring for unauthorized access to sensitive servers and maintaining strict access controls can reduce the likelihood of a successful data exfiltration event. Organizations should also focus on employee awareness training to defend against the phishing attacks that often follow a data leak.