Miller & Stewart listed on sarcoma ransomware leak site

• Ransomware group: sarcoma
• Country: Brazil
• Sector: Professional Services
• Announcement date: June 4, 2025

The professional services firm Miller & Stewart has been listed on the leak site of a threat actor group known as sarcoma. The announcement, which appeared on June 4, 2025, claims that the group has successfully exfiltrated data belonging to the organization.

The claimed attack and data breach

According to the announcement made by the sarcoma group, the alleged breach involves a significant volume of information. The group claims to have acquired a data archive with a total size of 13 GB. While the group has published this claim on their leak site, public information regarding the specific identity, tactics, or history of the sarcoma group remains limited.

The announcement specifies that the stolen information consists of certain file types and database formats. However, because no screenshots were provided by the threat actor to verify the contents, the specific details and the exact nature of the data remain unclear. The listing identifies the following as the affected data types:

• Files
• SQL database records

Organization profile

Miller & Stewart is a professional services firm that provides a variety of essential financial and administrative services. The firm specializes in offering tax, financial consulting, and accounting services to both individuals and small to medium-sized businesses. Their service model focuses on providing strategic support and year-round financial guidance to their client base.

Risk assessment and industry implications

The potential exposure of data from a firm like Miller & Stewart carries significant implications. If the allegedly leaked data contains sensitive information related to tax law or financial services, it could create substantial risks for the firm's clients, including the potential for fraud and identity theft. Furthermore, because the firm operates in Brazil, the incident may trigger legal obligations under the LGPD regulations, which could result in administrative penalties for the organization regarding data breach notifications.

The situation highlights the growing trend of double extortion tactics used by ransomware groups. In these scenarios, attackers do not just encrypt systems to disrupt operations; they also steal sensitive data to threaten the victim with public disclosure. This tactic is designed to maximize pressure on an organization, potentially impacting its operational continuity and long-term reputation. Additionally, there is a secondary risk that the leaked data could be utilized by other threat actors to conduct targeted phishing campaigns against the firm or its clients.

Given the firm's role in the professional services sector, this incident also points toward broader risks regarding supply chain security. Organizations in this sector often handle highly sensitive client information, making them high-value targets. To mitigate such risks, organizations typically focus on robust data protection strategies, such as implementing strict access controls, maintaining regular offline backups, and ensuring comprehensive encryption for data at rest and in transit. Monitoring for unauthorized data exfiltration and maintaining a strong incident response plan are also critical components of a modern cybersecurity posture.