Inox Laghi listed on sarcoma leak site

• Ransomware group: sarcoma
• Country: Italy
• Sector: Manufacturing
• Announcement date: August 27, 2025

Inox Laghi targeted by sarcoma group

The Italian manufacturing company Inox Laghi has been listed on a leak site by a threat actor group known as sarcoma. According to the announcement made on August 27, 2025, the group claims to have successfully targeted the organization and obtained a significant amount of data. This incident follows a pattern often seen in modern cyberattacks where threat actors use public leak sites to pressure victims by threatening to release sensitive information.

The claim made by the sarcoma group suggests a significant breach of the company's digital infrastructure. While the announcement was made on the same day as the claimed attack date, the specific details regarding the breach's entry point or the group's specific methods remain unconfirmed. The threat actor's primary method in such scenarios often involves double extortion, where data is not only encrypted but also stolen to be used as leverage for ransom demands.

Details of the alleged data exfiltration

The sarcoma group claims to have exfiltrated a substantial archive totaling 384 GB from Inox Laghi. The announcement specifies that this data volume is quite large and is intended to demonstrate the impact of the breach. Although the group has posted the claim on their leak site, no screenshots were provided to verify the contents of the stolen data at the time of the announcement.

According to the claims made by the threat actor, the stolen archive is expected to contain various types of sensitive information, including:

• Files
• SQL databases
• Exchange server data

The presence of Exchange server data is particularly concerning for many organizations, as it often contains a vast repository of internal corporate correspondence, which can be used to map out business relationships or conduct further social engineering attacks.

About Inox Laghi

Inox Laghi is an Italian company that provides stainless steel solutions for various industrial sectors. The company's reach extends across multiple critical industries, including the chemical, pharmaceutical, textile, petrochemical, food, paper, energy, and environmental sectors. By offering a complete range of products, the organization serves major industrial areas of international trade, making its operational stability and data integrity vital to its many industrial partners.

Potential risks and industry implications

This incident may pose significant risks to Inox Laghi's operational continuity and data privacy. The alleged exfiltration of corporate correspondence and database records could lead to third parties being targeted by phishing attacks, as attackers often use stolen communication logs to craft highly convincing fraudulent messages. Furthermore, because the institution operates in Italy, it may face administrative sanctions under GDPR regulations regarding data protection due to the potential exposure of personal or sensitive information.

Information about the sarcoma group remains limited, meaning the group's specific motivations and technical methods remain uncertain. There is also a secondary risk that the leaked data could be utilized by other ransomware actors to facilitate broader or more targeted attacks against the company or its supply chain. In the manufacturing sector, such breaches can disrupt complex supply chains and damage long-term business relationships.

To mitigate such risks, organizations in the industrial and manufacturing sectors often implement defensive strategies such as robust network segmentation, regular offline backups, and strict access controls for sensitive databases and mail servers. Monitoring for unauthorized data exfiltration and maintaining a comprehensive incident response plan are also essential components of a modern cybersecurity posture.