The PNST data leak claim by sarcoma group

• Ransomware group: sarcoma
• Country: Brazil
• Sector: Professional Services
• Announcement date: March 26, 2025

An allegation of a data leak involving The PNST

The sarcoma ransomware group has published an allegation on its leak site regarding a purported data breach involving the Brazilian law firm, The PNST. According to the announcement made on March 26, 2025, the group claims to have obtained sensitive information belonging to the organization.

Ransomware groups often utilize leak sites to increase pressure on their targets through a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The threat of releasing this stolen information publicly serves as a secondary lever to coerce the victim into paying a ransom. While the occurrence of such breaches is a growing concern in the cybersecurity landscape, the details surrounding individual incidents vary significantly depending on the group's methods and the target's defenses.

Details of the claim by sarcoma

The sarcoma group has listed data they claim belongs to The PNST on their leak site. The announcement states that the data in question amounts to 59 GB. While the group has made this public claim, they have not provided any detailed information regarding when the data was accessed or the specific methods used to obtain it.

The listing provides no specific details regarding the content of the allegedly leaked data. Furthermore, no screenshots or samples of the files have been provided by the group to substantiate their claims. The lack of transparency regarding the specific nature of the files makes it difficult to determine the exact scope of the exposure at this stage.

Affected data types

The listing names no specific data types.

About The PNST

Pacheco Neto Sanden Teisseire Advogados (PNST) is a full-service law firm based in Brazil. The firm provides a wide range of legal services to both national and international clients. It specializes in cross-border legal consulting, particularly focusing on assisting foreign investors who have significant interests in European markets.

Potential implications and industry risks

This incident may pose significant risks regarding client confidentiality and the protection of sensitive commercial information. Because law firms handle highly sensitive legal documentation and private client matters, any exposure of data can have far-reaching consequences. Depending on the actual content of the leaked data, legal processes under GDPR and relevant local data protection regulations may be triggered if the personal data of clients is exposed.

Beyond the immediate legal and regulatory concerns, there are significant secondary risks. The leaked information could potentially be used by malicious actors for identity theft or to conduct highly targeted phishing attacks against the firm's clients or partners. Such attacks often leverage the specific context of the stolen information to appear more legitimate and increase the success rate of the social engineering attempt.

The fact that the institution operates in the professional services sector may increase the potential for it to serve as a stepping stone for supply chain attacks. In a supply chain attack, a service provider is compromised to gain access to the much larger and more valuable networks of their clients. For professional service firms, maintaining robust security postures is critical to preventing them from becoming an entry point into the broader business ecosystem.

To mitigate these risks, organizations in the professional services sector typically focus on several defensive strategies. These include implementing strict access controls to ensure that sensitive client data is only available to authorized personnel, and utilizing encryption for data both at rest and in transit. Additionally, continuous monitoring of network traffic and regular security awareness training for employees can help detect and prevent unauthorized data exfiltration. As information about the sarcoma group remains limited, organizations are encouraged to remain vigilant against the evolving tactics used by such threat actors.