Curtidos Barbero Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized industrial and wholesale businesses across Europe, using data theft and public leak-site listings to pressure organisations into paying. In this landscape, even smaller specialist firms can appear on dark-web claim boards within days of an intrusion. On 9 October 2024 the Spanish leather-goods wholesaler Curtidos Barbero was listed by the ransomware group known as sarcoma, which claimed to have exfiltrated internal files during an attack.

Public detail remains limited: the number of people affected is unknown, and the precise contents of the stolen material have not been independently verified. The listing itself is a claim by the group, not a confirmed disclosure by the company. For customers, suppliers and staff who may have shared information with Curtidos Barbero, the episode still warrants careful attention.

What happened

According to the available record, Curtidos Barbero was listed on 9 October 2024 by the sarcoma ransomware group. The group asserted that internal files had been exfiltrated in a ransomware attack. No further technical details—such as the initial access vector, the duration of the intrusion, the volume of data taken, or any ransom demand—have been publicly confirmed. The number of individuals whose personal or business information may be involved is likewise unknown. The company’s own public statements on the matter, if any, are not part of the record used here.

The group behind it: sarcoma

Sarcoma is a ransomware operation that has appeared on public threat-intelligence trackers in recent years. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. Listings on such sites are therefore claims made by the actors themselves and should be treated as unverified until corroborated by the victim organisation or independent forensic evidence. Sarcoma has previously been associated with attacks on manufacturing, logistics and mid-market commercial targets, though specific prior victims are outside the scope of this incident. No additional statements attributed to sarcoma about Curtidos Barbero beyond the leak-site listing itself appear in the available facts.

Who is Curtidos Barbero?

Curtidos Barbero is a long-established Spanish wholesale business specialising in leather and related materials. Company material describes its origins in 1940 as a warehouse of tanned hides, built on decades of earlier experience in the currying trade. It presents itself as a supplier that maintains substantial stock for immediate delivery and emphasises personalised service, product quality and competitive pricing. Organisations of this type routinely hold commercial data: customer and supplier contact lists, order histories, invoices, shipping records, employee details and internal operational documents. A breach at such a firm can therefore affect both business partners and individuals whose personal information appears in those records.

The information in question

The only data category named in the public record is “internal files” said to have been exfiltrated during the ransomware attack. Exact file names, volumes or categories have not been disclosed. In the absence of confirmation, it is not possible to state which specific records—if any—were taken. Firms in the leather-wholesale sector typically store customer account details, purchase orders, delivery addresses, payment references and staff personal data. Whether any of those categories were among the files claimed by sarcoma remains unconfirmed. Readers should therefore treat the exposure as potential rather than proven for any particular individual.

Why it matters

Even when the precise contents of a theft are unknown, the real-world risks follow familiar patterns. Business customers may face invoice fraud or supply-chain disruption if commercial correspondence is misused. Individuals whose contact or identity details appear in the files could receive targeted phishing messages or social-engineering attempts that reference the company. For Curtidos Barbero itself, the incident carries operational, reputational and possible regulatory consequences under European data-protection rules, though no enforcement action is recorded here. Because the scale of the exfiltration and the number of people affected remain unknown, the prudent assumption is that anyone who has done business with the firm in recent years should treat the possibility of exposure seriously.

What to do if you're exposed

If you have had dealings with Curtidos Barbero—whether as a customer, supplier or employee—consider the following practical steps:

• Monitor bank and credit-card statements for unfamiliar transactions and enable transaction alerts where available.
• Treat any unexpected email, call or message that references the company or recent orders with caution; verify requests through a known official channel before acting.
• Change passwords for any accounts that reused credentials shared with the firm, and enable multi-factor authentication wherever possible.
• Request a free credit report or fraud alert from the relevant national credit bureau if you are concerned about identity misuse.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in public dumps.

These measures do not eliminate risk, but they reduce the chance that stolen data can be turned into immediate harm. Public detail on this particular incident remains limited; further verified information, if it emerges, should be followed through official company or regulatory channels.

AICompiled with AI assistance from public sources and published under our editorial standards.