NNC Firm targeted in data leak claim by sarcoma group

• Ransomware group: sarcoma
• Country: Canada
• Sector: Professional Services
• Announcement date: May 4, 2025

A data leak claim against NNC Firm published by sarcoma

The threat actor known as sarcoma has listed data allegedly belonging to the law firm NNC Firm on its leak site. This announcement, which appeared on May 4, 2025, represents a significant claim of a data breach against the Canadian-based professional services organization.

Ransomware groups often utilize leak sites as a method of double extortion. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also threaten to publish sensitive information on public forums if a ransom is not paid. This tactic is designed to maximize pressure on the victim by threatening their reputation and legal standing. While the claim has been made publicly, the breach has not been independently confirmed.

Details of the alleged theft

According to the announcement made by the sarcoma group, the threat actor claims to have obtained an archive of 960 GB from the organization's networks. The actor states that the data was successfully exfiltrated during an attack that allegedly occurred on May 4, 2025.

The announcement provides specific details regarding the nature of the stolen information, though it does not provide any screenshots of the data to verify the claim. The contents of the alleged leak are said to consist of the following:

• Files
• SQL database records

No information was provided regarding the specific amount of a ransom demand or the exact file count within the archive.

About NNC Firm

Nahwegahbow Corbiere, known as NNC Firm, is a law firm located in Canada. Established in 1982, the firm operates with a specific focus, acting exclusively for First Nation individuals, communities, and organizations. The firm specializes in several critical legal areas, including Aboriginal law, treaty rights, governance, and litigation.

Potential impact and organizational risks

This alleged leak may pose a risk of exposure for client information and sensitive legal documentation within NNC Firm. Given that the organization is based in Canada, a potential data breach could trigger legal obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA). Because the firm provides specialized legal services to Indigenous communities, the leaked data might be utilized for secondary risks such as targeted phishing or identity theft.

The sensitive nature of the firm's practice means that, if a breach is confirmed, it could potentially result in significant impacts on client confidentiality. For organizations operating in the professional services sector, especially those handling sensitive legal or community-related data, maintaining robust cybersecurity defenses is critical. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of initial access through phishing.

Information regarding the sarcoma group remains limited, making it difficult to attribute the attack or understand the full scope of their operations. However, the scale of the claimed data theft—nearly one terabyte—highlights the potential severity of such incidents for organizations managing high-stakes legal documentation and sensitive personal data.