cana group corp Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized companies across Latin America and the Caribbean, listing victims on leak sites to pressure payment even when full technical details remain scarce. In this environment, a January 2025 claim involving a Dominican consumer-goods firm illustrates how quickly operational data can become a bargaining chip.

Public records show that cana group corp was listed by the sarcoma ransomware group on 20 January 2025. The listing asserts that internal files were taken in a ransomware attack; the number of people affected, the volume of data, and the precise contents remain undisclosed. For customers, employees and partners of a company that supplies everyday consumer products, any confirmed exposure of internal material raises practical questions about identity and financial risk.

Inside the incident

According to the available breach record, cana group corp appeared on sarcoma’s leak site on 20 January 2025. The entry describes the organisation as operating under the brands Cana, Guidom and Fresh Cana and notes its location in the Dominican Republic. The sole concrete claim is that internal files were exfiltrated during a ransomware attack. No file count, archive size, sample screenshots or confirmation of encryption has been published in the record. The number of individuals potentially affected is listed as unknown, and both leak size and contents are marked “NO DATA.” Public detail on the initial access method, the duration of the intrusion, or any ransom demand is therefore limited.

Inside sarcoma

Sarcoma is a ransomware operation that follows the now-common double-extortion model: data is copied before systems are encrypted, and the threat of public release is used to compel payment. The group maintains a leak site where it posts victim names, sometimes accompanied by file samples or full archives once a deadline passes. Like other contemporary ransomware actors, sarcoma typically targets organisations whose operations depend on continuous access to internal systems and customer data. Its listings are claims made by the group itself; independent verification that a particular victim’s data was in fact stolen or that the group still possesses it is not automatically provided. In the present case the record contains only the listing and the assertion of internal-file exfiltration; no further statements attributed to sarcoma about cana group corp appear in the available facts.

Who is cana group corp?

Cana Group Corp is a Dominican Republic-based company that markets consumer products under the brands Cana, Guidom and Fresh Cana. Public descriptions indicate it focuses on anticipating consumer tastes and supplying everyday goods to the general public. Firms of this type ordinarily maintain customer contact lists, supplier contracts, inventory systems, employee records and internal financial documents. Because the company sits in the retail and food-distribution chain, a disruption or data exposure can affect both its commercial partners and the households that buy its products. The consequential nature of any breach therefore stems less from the organisation’s size than from the everyday personal and commercial data such businesses routinely hold.

What data was at risk

The breach record states only that “internal files” were exfiltrated. No inventory of those files—customer names, payment details, employee identifiers, contracts or other categories—has been disclosed. Organisations in the consumer-goods sector typically store order histories, loyalty or delivery addresses, supplier invoices and staff payroll information. Whether any of those categories were among the files taken remains unconfirmed. Readers should treat the precise contents as unknown until independent verification or official notification appears.

What's at stake

For individuals whose details may have been inside the internal files, the practical risks include targeted phishing that references real transactions, attempts to reset online accounts with partial personal data, and, in some cases, identity-fraud attempts if government identifiers or financial numbers were present. For the company itself, the stakes include operational downtime, potential regulatory scrutiny under Dominican data-protection rules, and reputational cost with retail partners. Because the scale of the leak is unreported, the actual number of people facing these risks cannot yet be quantified; the absence of that figure itself prolongs uncertainty for anyone who has done business with the firm.

Were you affected?

If you have been a customer, employee or supplier of cana group corp or its brands, treat the listing as a prompt for basic hygiene rather than confirmed compromise. Practical first steps include:

• Monitor bank and card statements for unfamiliar charges and enable transaction alerts.
• Change passwords on any accounts that reused credentials linked to the company, and turn on multi-factor authentication where available.
• Be sceptical of unsolicited messages that claim to come from Cana, Guidom or Fresh Cana and that request personal or payment information.
• Request a free credit or identity-monitoring report if you reside in a jurisdiction that provides one, and keep records of any suspicious contact.

You can also run a free exposure scan of your email address against known breach data sets to see whether your information has already appeared in other incidents. Official notification from the company, if it comes, will remain the most reliable source of confirmation about this specific event.

AICompiled with AI assistance from public sources and published under our editorial standards.