National Edging targeted by sarcoma ransomware group

• Ransomware group: sarcoma
• Country: South Africa
• Sector: Manufacturing
• Announcement date: March 22, 2025

Sarcoma claims data leak involving National Edging

The threat actor known as sarcoma has announced the alleged leak of data belonging to National Edging on their dedicated leak site. According to the announcement made on March 22, 2025, the group claims to have acquired a significant amount of information from the organization. This incident follows a claimed attack date of July 9, 2024.

Ransomware groups often utilize leak sites to exert pressure on victims through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data. If the ransom is not paid, the attackers threaten to publish the stolen information publicly to damage the victim's reputation or force compliance through the threat of regulatory fines and loss of customer trust.

Details of the alleged data breach

The sarcoma group has listed data allegedly belonging to National Edging on their leak platform. The threat actor claims that the stolen information consists of a 120 GB archive. While the total volume of the data has been specified, the specific file count was not provided in the announcement. Furthermore, no information was provided regarding a ransom demand.

According to the information provided in the announcement, the leaked data is said to contain various types of information. However, as there is no screenshot available to verify the contents, further details regarding the specific nature of the data cannot be verified at this time. The listing identifies the following types of affected data:

• SQL database records
• File contents

The presence of SQL database records is particularly concerning in cyberattacks, as these files often contain structured information that can include sensitive operational details or customer records. When attackers gain access to databases, they can potentially extract vast amounts of organized data, which can be used for various malicious purposes ranging from corporate espionage to identity theft.

About National Edging

National Edging is a manufacturing company based in South Africa. Established in 1997, the firm specializes in the production and distribution of a wide range of furniture fittings and design components. The company provides edgebanding and adhesive solutions to the kitchen, furniture, and shop-fitting industries across Sub-Saharan Africa.

Potential risks and implications

This incident may pose a risk of exposure for sensitive corporate data and customer information within National Edging. The leaked SQL database records could indicate that unauthorized access to the organization's operational processes or customer data may have occurred. As an organization operating in South Africa, this incident may lead to legal consequences under the Protection of Personal Information Act (POPIA).

Furthermore, the public release of this data could create secondary risks such as identity theft or targeted phishing attacks for the organization's supply chain partners and customers. When manufacturing data is leaked, the impact often extends beyond the immediate victim to include their entire network of suppliers and clients.

Information regarding the sarcoma group is limited. In general, organizations facing such threats are encouraged to implement robust defensive measures. These include maintaining offline backups, implementing multi-factor authentication (MFA) across all systems, and conducting regular security audits to identify vulnerabilities. Strengthening network segmentation and monitoring for unusual data exfiltration patterns are also critical steps in defending against modern ransomware campaigns.