Boart & Wire Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized manufacturers across Europe, using double-extortion tactics that combine system encryption with threats to publish stolen data. Against that backdrop, Boart & Wire appeared on a sarcoma leak site listing dated 14 January 2025. Public information is sparse: the group claims internal files were taken, yet the number of people affected remains unknown and no independent confirmation of the intrusion has been released.

For employees, suppliers and customers of a specialised industrial firm, even limited disclosure of internal material can create lasting operational and privacy risks. The following account stays strictly within the reported facts and established public knowledge of the actors involved.

What happened

On 14 January 2025 Boart & Wire was listed by the sarcoma ransomware group. The listing asserts that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access vector, the precise date of compromise, the volume of data removed, or whether encryption was also deployed—have been made public. The number of individuals whose information may have been involved is recorded as unknown. All statements about the incident therefore rest on the group’s own claim and the limited summary available from open reporting.

Inside sarcoma

Sarcoma is a ransomware operation that follows the now-common double-extortion model. After gaining access to a network, the group typically steals data before encrypting systems, then posts the victim’s name on a dedicated leak site to increase pressure for payment. Public reporting over recent years shows sarcoma focusing on manufacturing, logistics and professional-services firms of moderate size, often those with limited in-house security resources. The group publishes sample files or full archives when negotiations stall, a practice documented across multiple unrelated incidents. Nothing in the public record states that sarcoma has released any Boart & Wire material beyond the initial listing itself; the claim of exfiltration remains unverified by independent sources.

Boart & Wire and its sector

Boart & Wire describes itself as a worldwide manufacturer and marketer of diamond wires, discs and blades used in the stone-processing industry. Founded in 2005 in Fara Vicentino, Italy, the company expanded rapidly through research-and-development investment and the opening of production and sales offices internationally. Organisations of this type routinely maintain technical drawings, production schedules, supplier contracts, employee records and customer order histories. A breach in such an environment can expose proprietary process knowledge as well as personal data belonging to staff and commercial partners, creating both competitive and privacy consequences that extend beyond the immediate disruption of operations.

What data was at risk

The only data category named in available reporting is “internal files exfiltrated in ransomware attack.” Exact file types, volumes or sensitivity levels have not been disclosed. Companies operating in precision manufacturing typically hold a mix of the following categories, though none of these can be confirmed as present in the present incident:

• Employee personnel and payroll records
• Technical specifications and research documentation
• Supplier and customer commercial correspondence
• Internal financial and logistics spreadsheets

Because the precise contents remain unconfirmed, any assessment of impact must treat these categories as illustrative rather than established fact.

Why it matters

For individuals whose details may appear among the internal files, the principal risks are opportunistic misuse of contact information, credentials or identity documents should those files later surface. For the organisation, the consequences include potential interruption of production planning, loss of proprietary process knowledge to competitors, and the administrative burden of investigating and notifying affected parties under European data-protection rules. Even when a ransomware group’s claims are never fully substantiated, the mere listing can erode commercial confidence and force costly forensic reviews. In the stone-tool sector, where specialised know-how is a core asset, such exposure carries particular weight.

Were you affected?

If you have worked for, supplied or purchased from Boart & Wire, treat the possibility of exposure as real until proven otherwise. Practical first steps include:

• Changing passwords on any accounts that used a work email address associated with the company
• Enabling multi-factor authentication wherever available
• Monitoring bank and credit statements for unfamiliar activity
• Requesting a free credit report if you reside in a jurisdiction that provides one

Readers can also run a free exposure scan of their personal email address against known breach data sets to determine whether that address has already appeared in other publicly documented incidents. Remain alert for unsolicited messages that reference the company or request sensitive information; such messages may be phishing attempts that exploit the publicity surrounding the listing.

AICompiled with AI assistance from public sources and published under our editorial standards.