Upstate Glass Tempering targeted by sarcoma ransomware group

• Ransomware group: sarcoma
• Country: Spain
• Sector: Manufacturing
• Announcement date: February 10, 2025

Sarcoma group claims data breach at Upstate Glass Tempering

The sarcoma ransomware group has claimed to have compromised data belonging to the manufacturing company Upstate Glass Tempering. According to an announcement made on a leak site on February 10, 2025, the threat actor group alleges they have successfully exfiltrated significant amounts of information from the organization.

In modern cyberattacks, ransomware groups often employ a tactic known as double extortion. This method involves not only encrypting an organization's systems to disrupt operations but also stealing sensitive data to use as leverage. By threatening to publish or sell the stolen information on public leak sites, attackers aim to pressure the victim into paying a ransom. The presence of a leak site announcement is a hallmark of this strategy, serving as a public warning to the targeted entity.

Details of the alleged data theft

The sarcoma group has listed a 95 GB archive on its leak site, which it claims belongs to Upstate Glass Tempering. The group has indicated its intent to publish or sell this information. While the group has made these claims, information regarding this specific group remains limited in the public domain. No screenshots were provided in the announcement to verify the contents of the stolen data.

The information allegedly stolen by the group includes various types of sensitive digital assets. According to the claim, the breach involves:

• SQL databases
• Exchange server data
• File archives

The inclusion of such diverse data types suggests a broad reach into the organization's digital infrastructure, potentially touching both operational and communication systems.

About Upstate Glass Tempering

Upstate Glass Tempering is a glass processing company that provides custom glass tempering and lamination services. They specialize in high-quality, custom-made glass solutions for architectural projects and protective glass coating technologies.

Potential impact and organizational risks

The alleged leak may pose significant risks to the company's operational continuity and trade secrets. The presence of SQL and Exchange data suggests that personal information of employees or customers could be exposed, which may lead to regulatory consequences under GDPR. Furthermore, secondary risks may include the use of leaked data for identity theft or targeted phishing campaigns.

Beyond the immediate organization, supply chain partners of the organization could also be indirectly affected by such a breach. When a manufacturer's data is compromised, the interconnected nature of modern business means that partners, clients, and vendors may face increased exposure to subsequent social engineering or technical attacks.

If the breach is verified, the organization may need to re-evaluate the security of its digital assets. For organizations operating in the manufacturing sector, maintaining robust security postures is critical. Common defensive steps often include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities in server configurations and database access controls. Monitoring for unusual data exfiltration patterns can also serve as an early warning system for potential breaches.