Sarcoma
Data as of August 16, 2026.
Credential exposure before the attack
30.6% of Sarcoma victims whose domain we can identify (44 of 144) had employee credentials leak in the 12 months before Sarcoma named them as a victim.
We don't know whether any of these credentials were how Sarcoma gained initial access.
What industries Sarcoma targets
Sector identified for 86 of 144 victims.
| Construction | 16 | |
| Manufacturing | 15 | |
| Financial Services | 13 | |
| Logistics | 8 | |
| Legal | 8 | |
| Healthcare | 8 | |
| Energy | 3 | |
| Retail | 3 |
Where the victims are located
Country identified for 82 of 144 victims.
| Germany | 14 | |
| Italy | 8 | |
| Canada | 8 | |
| Brazil | 7 | |
| Australia | 7 | |
| United Kingdom | 5 | |
| United States | 5 | |
| South Africa | 3 |
Most recent Sarcoma victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| GYF Inteligencia Digital gyf.com.ar | Financial Services | Argentina | Mar 31, 2026 |
| Propane Levac propanelevac.ca | Energy | Canada | Jan 26, 2026 |
| Mecmatica mecmatica.it | Manufacturing | Italy | Jan 21, 2026 |
| Söllner Bedachungen bedachungen-soellner.de | Construction | Germany | Nov 21, 2025 |
| B&J Rocket bj-rocket.com | Manufacturing | Switzerland | Nov 19, 2025 |
| Paul Hildebrandt hildebrandt.de | Logistics | Germany | Nov 11, 2025 |
| Unimed unimed.coop.br | Healthcare | Brazil | Oct 27, 2025 |
| Charter Industrial Supply charterindustrial.com | Manufacturing | United States | Oct 9, 2025 |
| MSB msbuilders.com | Construction | United States | Sep 29, 2025 |
| MACMA Werbeartikel macma.de | Not identified | Germany | Sep 25, 2025 |
| Thermofin thermofin.de | Manufacturing | Germany | Sep 23, 2025 |
| Miami Management miamimanagement.com | Financial Services | Not identified | Sep 22, 2025 |
| IAD iad.de | Education | Germany | Sep 18, 2025 |
| KWG Senftenberg kwg-senftenberg.de | Not identified | Germany | Sep 18, 2025 |
| Pfullendorfer Tor-Systeme pfullendorfer.de | Manufacturing | Germany | Sep 18, 2025 |
| F1-Generation f1-generation.com | Not identified | Germany | Sep 17, 2025 |
| Inox Laghi inoxlaghi.com | Manufacturing | Italy | Aug 27, 2025 |
| Maselli Misure maselli.com | Manufacturing | Italy | Aug 15, 2025 |
| Harinera del Valle hv.com.co | Manufacturing | Colombia | Aug 7, 2025 |
| Metro Heating and Air metroheatingandair.com | Not identified | United States | Aug 7, 2025 |
Showing the 20 most recent of 144. Browse recent data breaches for more.
Sarcoma leak sites
Addresses we've seen Sarcoma publish victims from. Any .onion address needs the Tor Browser.
sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad.onionnfh5wuh4gvbai237npdu672xmx2di2lo7pcwu6th2a7kzgue2fnhhdad.onionsfhvr7ecppro35ch6vhrzgwtdtv3ehxem6p2thnwlgursr5vdre2nhid.onione2hziphckfndi5osd3dr24qbs5gccsk4ebsmx5l4udf54qgbsw5vl3qd.onion5q3lywcjrujw3vao7cz3ruqd57ugfdcu3qiisklpqillvuidl5wiqlqd.onioncgewcqt4x7kb7xgkfu2r3yv5wifzvpx6tojonay3kdgs5tqpjvkd5bqd.onion4tgkspsiob5zg7vwqmmbquymoj3sacpx4x4qixvgzukjfen4ck4s6mad.onionsbgsnuet6t7kle4tfmgsvgebaqgxab3lrslg6vjeabphzq7jx5232byd.onionlq4acyymyobtq7tafyspo7zlm4bwnmpyyknbtb3zefq2zdy3xxiu5nad.onionqccbb75hak6ze6rsm344rx73lh7rk6caha2hvleyopejhtgagxjyioqd.onion73jrahivyj7cydl3qeiauwm4fkz4f7e4d3deny6qt3cgtwxmkj2vmiyd.onionenfxn727mx4ue55zgbjkogn3lnb57e5ed7bcooodxsajzsp3dyo5xeyd.onionzp6bziy6wljpkg6i3uxzzcxyajodxzoc7acf5egb2vhzzrot23y3mpyd.onionrzsqkmwfyprkqslslcf4lscqk7x24xzbxamm5jcsqqhj3vrvkdtp4did.oniondj3t7qdgyopmjnvjvni7kdfne36zlq4uic5ajqrh45stquvxcwtdc3qd.onionf6cwflfjehjl6hosqy7jnkefhddnk7u3eyqn4bjrufmkle53tptxr3ad.onionnt5fhl4xanqgcpmd63tc2v23rmuropsznaokhymkubf2nvks4aecs3ad.onionzncifh3szqf6awg3o33qyoi43tzjaakcjmmhuytii5bsl33wwblt7yid.onionmdliyoqm37i6ze4grykoa7mc6tltrjfvr5mffhvotrf6hsi5mwsx3myd.onionob4kfkvgqxbiddrhzlq2yhlyfpdmnro4yptt24drsjvcekczjjaf5myd.oniont3ym2cemf625rd5slz5ifp2jz2ldntmlbn74i5joebg6c74fmnpmuyqd.onionl2atrqqwpmgdr4vzae7ufgulirsklfk4xmierg4ihdxborjkpyuz5lyd.onionjdphsfcjuyog5cgtjdfsxluarkvqy5rw75kasoj6kuihga3bs3fwgfyd.onionbi32pq7y3gqq3qacgvamnk2s2elnppvevqp325wtk2wo7vh2zavjcfid.onionrs3icoalw6bdgedspnmt6vp2dzzuyqxtccezmta2g5mlyao64len7dyd.onion
Sarcoma questions
Is Sarcoma still active?
It's gone quiet. The last victim we recorded was March 31, 2026, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has Sarcoma claimed?
Sarcoma has named 144 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 17 of them were posted in the last 12 months.
When did Sarcoma first appear?
The first victim we recorded for Sarcoma was posted on October 10, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Sarcoma target?
Construction accounts for the most victims we can classify, with 16. Manufacturing follows at 15. We could identify a sector for 86 of 144 victims, so treat this as the shape of the targeting rather than a full census.
Has Sarcoma already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.