Sanderling listed on sarcoma ransomware leak site

• Ransomware group: sarcoma
• Country: United States
• Sector: Healthcare
• Announcement date: July 3, 2025

The sarcoma group claims a breach at Sanderling

The healthcare organization Sanderling has been listed on a leak site by the threat actor group known as sarcoma. According to the announcement made on July 3, 2025, the group claims to have successfully exfiltrated data belonging to the organization and is now using it as leverage in an extortion attempt.

The threat actor states that a ransom of $200,000 is being demanded from the organization to prevent the release of the stolen information. The group has employed a double-extortion tactic, a common method in modern ransomware attacks where criminals not only encrypt an organization's systems but also steal sensitive data to threaten public disclosure. In this specific case, the group has noted that any data that remains unsold may be published publicly if the ransom demands are not met. Information regarding the specific identity or background of the sarcoma group remains limited.

Alleged data contents and sensitive information

The announcement made by the threat actor claims that the stolen datasets include Oracle database backups, Exchange server backups, and various other corporate files. While no screenshot was provided to verify the contents of the breach, the group alleges that the information is highly sensitive and contains a wide array of personal and corporate data.

The following types of information are claimed to be included in the breach:

• Patient health records
• Personal contact information
• Social Security Numbers
• Passport and driver's license details

The exposure of such a diverse range of data, spanning from medical records to government-issued identification, represents a significant security incident for the targeted entity.

About Sanderling

Sanderling Renal Services is a healthcare company that provides dialysis and nephrology services to rural communities and home dialysis patients across the United States. The company leverages a network of licensed physicians and telemedicine technologies to deliver specialized kidney care services.

Impact and industry implications

This alleged data breach may pose significant risks of identity theft and fraud for the individuals involved due to the exposure of personal and medical information. Given the organization's location in the United States, a potential breach could trigger legal processes under HIPAA regulations, which govern the privacy and security of protected health information.

The sensitivity of the alleged data may negatively impact patient privacy and could lead to reputational damage for the organization. Furthermore, the alleged corporate backups could be utilized by threat actors for secondary attacks or could present significant supply chain risks. When organizations face such threats, they often look toward defensive strategies such as implementing robust encryption, maintaining offline backups, and enforcing strict access controls to mitigate the impact of exfiltration.

The use of double-extortion tactics, as seen in this claim, highlights the evolving nature of cyber threats where the pressure to pay is driven by the fear of public exposure rather than just system downtime. For healthcare providers, the intersection of highly regulated data and high-value personal information makes them a frequent target for such sophisticated extortion schemes.