R&K Drysdales targeted in alleged data breach by sarcoma
The threat actor known as sarcoma claims to have leaked data belonging to the agricultural and food production company R&K Drysdales.
- Published
- 3 min read
- 3 min read
- Ransomware group: sarcoma
- Country: United Kingdom
- Sector: Agriculture and Food Production
- Announcement date: March 26, 2025
Sarcoma group claims data breach at R&K Drysdales
The threat actor known as sarcoma has claimed to have leaked data belonging to the agricultural and food production company R&K Drysdales. According to an announcement made on a leak site on March 26, 2025, the group alleges they have successfully exfiltrated a significant volume of information from the organization's network.
Ransomware attacks often involve a tactic known as double extortion, where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data. The threat actors then threaten to publish or sell this stolen information on public leak sites if their demands are not met. This pressure tactic is designed to maximize the impact on the victim by threatening their reputation and legal standing.
Details of the alleged leak
The sarcoma group has listed a data archive on its leak site that is allegedly linked to R&K Drysdales. The group claims that the archive is approximately 80 GB in size. According to the announcement, the stolen information consists of various files and records obtained from the company's network. The group has indicated its intention to either publish the data or sell it to other parties.
While the group has provided the size of the archive, they have not provided any screenshots to verify the contents of the leak. Furthermore, no specific information regarding the ransom demand has been made public. Information regarding the specific methods, motivations, or identity of the sarcoma group remains limited in the public domain, making it difficult to assess the full scope of their operational patterns.
The data types mentioned in the claim include:
- Files
- SQL database records
About R&K Drysdales
R&K Drysdales operates within the agriculture and food production sector. While the provided profile for the organization describes East of Scotland Growers (ESG) as a farmer-owned agricultural cooperative based in the Fife region of Scotland, specializing in the cultivation and marketing of vegetable crops such as broccoli, Brussels sprouts, and cauliflower, and acting as a recognized producer organization by the European Union, the specific details of R&K Drysdales' internal operations are not detailed beyond its industry classification.
Potential implications and industry risks
If the claims made by the sarcoma group are verified, the disclosure of the company's operational data and commercial information may occur. The impact of such a breach can be multifaceted. If the contents of the SQL databases include sensitive information regarding employees or suppliers, the organization could face legal consequences under the UK GDPR (General Data Protection Regulation).
Beyond legal and regulatory risks, a data breach of this nature can cause significant disruptions in a company's supply chain. Furthermore, the exposure of corporate data can potentially facilitate targeted phishing attacks against third parties, such as business partners or customers, who may be targeted using the stolen information.
Organizations operating in the agricultural and food production sectors can take several defensive steps to mitigate these risks. Implementing robust network segmentation can help prevent attackers from moving laterally through a network to reach sensitive databases. Regular, offline backups are essential for recovery, while strong access controls and multi-factor authentication can reduce the likelihood of unauthorized entry. Continuous monitoring of network traffic can also help detect unusual data exfiltration activities before large volumes of data are lost.