Sarcoma claims to have leaked data from MSB

• Ransomware group: Sarcoma
• Country: United States
• Announcement date: September 29, 2025

The threat actor known as Sarcoma has claimed responsibility for a data breach involving MSB, a general contractor based in the United States. According to an announcement made on a ransomware leak site on September 29, 2025, the group alleges that it has successfully exfiltrated a significant volume of data belonging to the organization.

Details of the alleged claim

The threat group, Sarcoma, has listed the organization on its dedicated leak site. The group claims that the attack occurred on September 29, 2025, the same day the announcement was posted. While the group has made these claims publicly, information regarding the specific identity, tactics, or background of the Sarcoma group remains limited in the public domain.

Ransomware attacks often follow a pattern of double extortion, where attackers not only encrypt an organization's systems but also steal sensitive information to use as leverage. By threatening to release stolen data on a public leak site, threat actors aim to pressure the victim into paying a ransom to prevent the exposure of confidential files. This tactic increases the pressure on the target organization, as the leak of sensitive information can lead to severe reputational and legal consequences.

Scope of the leaked information

The Sarcoma group claims that the stolen data consists of approximately 66 GB of information. According to the group's announcement, the exfiltrated data is comprised of specific formats that may include:

• File data
• SQL database records

The threat actor stated that the data includes both files and SQL formats. However, it is important to note that the group did not provide any screenshots or samples of the data to support their claims. Consequently, the specific details and the actual content of the leaked information cannot be verified at this time.

About MSB

MSB General Contractors is a construction company operating within the United States. The firm specializes in providing disaster recovery and restoration services for both residential and commercial projects. Additionally, the organization focuses its professional activities on emergency management and humanitarian aid efforts.

Potential risks and organizational implications

The alleged data leak poses several significant risks to MSB's business operations and the privacy of its clients. The presence of SQL databases in the claimed leak suggests a potential exposure of sensitive customer or operational data, which is often stored in structured database formats. For an organization involved in disaster recovery and humanitarian aid, the integrity and confidentiality of operational data are critical.

Because the organization is based in the United States, the alleged exposure of data may trigger various state-level data protection laws and potential notification obligations to regulators and affected parties. Furthermore, the exposed information could be exploited by malicious actors to facilitate identity theft or to launch targeted phishing attacks against the organization's employees and its client base. There is also a secondary risk that the leaked information could be utilized to conduct supply chain attacks, where the breach of one partner or contractor is used as a stepping stone to compromise other entities within the supply chain.

To defend against such threats, organizations typically implement multi-layered security strategies. Common defensive steps include maintaining robust, offline backups to ensure data availability, implementing strict access controls to limit the exposure of sensitive databases, and conducting regular employee training to recognize phishing attempts. Continuous monitoring of network traffic can also help detect unauthorized data exfiltration before large volumes of data are moved out of the environment.