Pfullendorfer Tor-Systeme listed on sarcoma leak site

• Ransomware group: sarcoma
• Country: Germany
• Sector: Manufacturing
• Announcement date: September 17, 2025

The threat actor group known as sarcoma has listed the German manufacturing company Pfullendorfer Tor-Systeme on its leak site. According to the claims made by the group, a significant data breach has occurred, involving a substantial volume of stolen information.

The claimed incident

The sarcoma group has published information on its leak site asserting that the data belongs to Pfullendorfer Tor-Systeme. The threat actor states that the incident allegedly took place on September 17, 2025. According to the group's claims, a massive archive totaling 643 GB was compromised during this event. While the group has made these claims, information regarding the specific identity and operational details of the sarcoma group remains limited.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers do not only encrypt an organization's systems to disrupt operations but also steal sensitive data to pressure the victim into paying a ransom. The threat of leaking this stolen data on a public platform is used to increase the pressure on the target organization to comply with their demands.

Data involved in the breach

Based on the information provided by the leak site, the compromised data is said to include several types of sensitive information. While the group has not provided any screenshots to validate their claims, the listing specifies the following types of data as being part of the breach:

• File archives
• Exchange server data

The presence of Exchange server data in a breach often indicates that the attackers may have gained access to internal communications, which can include sensitive corporate discussions and potentially employee or client contact information.

Organizational profile

Pfullendorfer Tor-Systeme is a German company that has been manufacturing high-quality and durable tilt door systems for garages since 1949. The company is known for its customizable design options and long-lasting product solutions.

Potential impact and implications

The allegedly leaked data may contain personal information of the company's 400,000+ customers or sensitive trade secrets. This situation could trigger data breach notification obligations under the GDPR applicable within the European Union. Furthermore, the exposure of commercial data from a manufacturing entity could harm competitive advantage and pose risks to supply chain security. Given the methods of the sarcoma group, the publication of this data may create negative impacts on corporate reputation.

Secondary risks arising from such a breach may include identity theft or targeted phishing attacks against the company's employees and customers. When attackers obtain internal data, they can craft highly convincing social engineering attacks, using stolen context to deceive individuals within the organization or its client base.

To mitigate these types of risks, organizations in the manufacturing sector often implement defensive strategies such as robust network segmentation, multi-factor authentication, and regular offline backups. Protecting the supply chain is also critical, as a breach in one manufacturer can potentially create vulnerabilities for its partners and customers. Continuous monitoring of network traffic and strict access controls for sensitive servers, such as Exchange servers, are standard industry practices to defend against unauthorized data exfiltration.