ICS Nett listed on sarcoma leak site

• Ransomware group: sarcoma
• Country: United States
• Sector: Technology
• Announcement date: March 22, 2025

Technology firm ICS Nett listed on sarcoma leak site

The technology firm ICS Nett has been listed on the leak site of the threat group known as sarcoma. The threat actor has made a claim regarding a data breach involving the organization, though public information regarding the group known as sarcoma remains limited.

Details of the claimed attack

The sarcoma group published a post on March 22, 2025, claiming to have compromised data belonging to ICS Nett. According to the post, the group alleges the existence of a 35 GB archive that was obtained from the organization's networks. While the announcement was made on March 22, 2025, the group has claimed the attack occurred on July 9, 2024.

Ransomware groups often utilize leak sites to pressure victims through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. This creates a dual pressure point: the need to restore operational capacity and the need to prevent the exposure of confidential information.

Data involved in the leak claim

The leaked data is claimed to consist of the following:

• SQL database files

No screenshot has been provided to verify the contents of the alleged archive. No information was provided regarding a ransom demand or the specific file count within the archive.

About ICS Nett

Founded in 2003, ICS Nett is a technology company providing services in cybersecurity, cloud solutions, data analytics, and IT infrastructure optimization to government, military, and private sector clients. As a Small Disadvantaged Business (SDB), the firm specializes in digitalization and modernization projects.

Potential impact and organizational risks

The leak claim may raise data privacy concerns for the organization's clients and business partners. The presence of SQL files could increase the risk of exposing sensitive corporate or customer information. As a US-based entity, a potential data breach may trigger legal processes under state-level data protection laws and sectoral regulations.

Secondary risks may include the potential use of leaked data in identity theft or targeted phishing attacks. The threat actor's intent to publish the data may impact the organization's reputation and operational security. When organizations face such threats, common defensive steps often include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security audits to identify vulnerabilities in network infrastructure.

Risk assessment of the incident

The nature of the data mentioned in the claim suggests a high level of sensitivity. SQL database files typically contain structured information that can include user credentials, customer records, or proprietary business logic. If such files are indeed exfiltrated, the impact extends beyond the immediate technical disruption of an attack to the long-term integrity of the organization's data ecosystem.

Furthermore, for a company serving government and military clients, the implications of a data breach involve heightened scrutiny. Organizations in the technology sector that handle critical infrastructure or sensitive modernization projects must prioritize data integrity to maintain trust with high-stakes stakeholders. The potential for secondary exploitation of the data remains a significant concern for any organization facing a leak site listing.