Söllner listed on sarcoma ransomware leak site

• Ransomware group: sarcoma
• Country: Germany
• Sector: Manufacturing
• Announcement date: November 20, 2025

German construction company targeted by sarcoma ransomware group

The German manufacturing company Söllner has been listed on the leak site of the ransomware group known as sarcoma. According to an announcement made by the threat actors, the organization has fallen victim to a data breach involving a significant volume of information.

The claim made by sarcoma

On November 20, 2025, the threat group known as sarcoma published a post on their leak site alleging that data belonging to Söllner has been exfiltrated. The group claims that they have obtained an archive totaling 286 GB from the institution. While the group has made this public claim, public information regarding the specific activities and background of the sarcoma group remains limited.

Ransomware groups often use leak sites to host announcements following a successful intrusion. These platforms serve as a method of public pressure, where the attackers list the names of their victims to increase the visibility of the breach. This tactic is frequently used to coerce organizations into meeting ransom demands by threatening to release sensitive information to the public or to industry competitors.

Details of the alleged data exfiltration

The information provided by the threat group suggests that the leaked data consists of various digital assets. While no screenshots of the stolen data have been provided to verify the claim, the group indicates that the breach involves the following types of information:

• Files
• SQL database

In many modern cyberattacks, the theft of SQL databases is a critical component of the breach, as these databases often contain structured information essential to the operations of a company. When attackers target these databases, they aim to acquire large quantities of organized data, which can include sensitive business records or client information.

About Söllner

Söllner is a German construction company with a long-standing history in the industry. Managed by the same family for four generations since 1902, the organization specializes in several key areas of construction and architectural services. Their expertise includes roofing, carpentry, facade construction, and scaffolding. Additionally, the company provides comprehensive architectural design and execution services.

Potential impact and security implications

The implications of this alleged breach depend heavily on the actual content of the stolen data. If the claims made by sarcoma are accurate, the company's trade secrets and customer information may be at risk. Because Söllner operates within Germany, a confirmed data breach could lead to significant legal sanctions under the General Data Protection Regulation (GDPR), which governs data privacy and protection in the European Union.

Furthermore, the exposure of employee and customer data may increase the likelihood of those affected individuals being targeted by subsequent malicious activities, such as identity theft or phishing attacks. In such scenarios, attackers use the stolen information to craft highly convincing fraudulent communications to deceive victims.

The nature of this incident suggests that the group may be attempting to exert pressure on the company's operational continuity through double extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt a company's systems to halt operations but also steal sensitive data to use as leverage during negotiations. By threatening to leak the data, the attackers aim to ensure payment even if the company has robust backups to restore their systems.

To defend against such threats, organizations in the manufacturing and construction sectors typically implement layered security strategies. This includes maintaining offline, immutable backups to ensure operational continuity and implementing strict access controls to limit the movement of attackers within a network. Additionally, continuous monitoring and data loss prevention measures are essential to detect and mitigate unauthorized data exfiltration before it reaches a critical scale.