Thermofin allegedly targeted by sarcoma ransomware group

• Ransomware group: sarcoma
• Country: Canada
• Sector: Manufacturing
• Announcement date: September 23, 2025

The manufacturing company Thermofin has allegedly been targeted in a data breach by the ransomware group known as sarcoma. On September 23, 2025, the group listed a significant amount of data on their leak site, claiming the information belongs to the organization.

The alleged data breach event

According to the announcement made by the sarcoma group on their leak site, the group has claimed responsibility for a breach involving Thermofin. The group asserts that they have acquired 2.9 TB of data belonging to the company. The announcement specifically states that the compromised information is related to the company's operations within the industrial cooling solutions sector.

The details surrounding the sarcoma group remain limited, as there is very little information available in the public domain regarding this specific threat actor. Ransomware groups often utilize leak sites as a tool for double extortion, a tactic where attackers not only encrypt an organization's systems but also threaten to release sensitive data publicly to increase pressure during ransom negotiations. While the group has made these claims, no screenshots were provided to support the assertion that the data belongs to the target.

Details of the claimed compromised data

The data allegedly stolen by the sarcoma group is said to consist of various sensitive information types. While no specific file count was provided in the announcement, the volume of the data is reported to be 2.9 TB. The content of the leaked data is claimed to include several critical components of an organization's digital infrastructure and documentation.

The specific types of data mentioned in the claim include:

• SQL databases
• Exchange server records
• Corporate files

The presence of such data types suggests a broad reach into the organization's internal systems, potentially touching upon both operational and administrative layers.

About Thermofin

Thermofin GmbH is a German company that manufactures high-performance cooling solutions. Their product line includes evaporators, air coolers, and heat pumps designed for the industrial refrigeration and air conditioning sectors. Established in 2002, the company focuses on developing innovative thermal management systems to serve both commercial and industrial clients.

Potential impact and organizational risks

The content of the alleged data leak may pose significant risks to the organization's operational continuity and its trade secrets. Because the claim includes the theft of SQL databases and Exchange server records, there is a strong indication that personal information belonging to employees or customers could have been exposed. Such an exposure may trigger data breach notification obligations under the General Data Protection Regulation (GDPR) for the organization.

Beyond the immediate data exposure, secondary risks include the potential for the leaked data to be used for identity theft or targeted phishing attacks against the company or its stakeholders. Furthermore, the organization's supply chain partners may also be indirectly affected by this incident, as data breaches in manufacturing often ripple through the connected network of vendors and clients.

In general, organizations in the manufacturing sector can mitigate such risks by implementing robust defensive measures. These include maintaining offline backups, enforcing multi-factor authentication across all services, and conducting regular security audits. Protecting sensitive intellectual property and customer data is essential for maintaining trust and ensuring long-term operational stability in a highly connected industrial landscape.