Decoline Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 4 May 2025, the Belgian window-decoration company Decoline appeared on the leak site of the ransomware group known as sarcoma. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown and no further technical details have been released. The listing itself is a claim by the group and has not been independently confirmed in the available record.

For a firm that designs and supplies curtain-hanging systems and professional window solutions, the exposure of internal material raises practical questions about business continuity, supplier and customer relationships, and any personal or commercial data that may have been stored alongside operational files. What follows is a factual account of what is known so far.

Breaking down the breach

According to the public record, Decoline was listed by sarcoma on 4 May 2025. The only data description supplied is that internal files were allegedly exfiltrated during a ransomware attack. No figure for the volume of data, no list of specific file types beyond the general label “internal files,” no confirmation of encryption or operational disruption, and no statement of how many individuals or organisations may be affected have been disclosed. Timing of the intrusion itself, the initial access vector, and any ransom demand are likewise unreported. The incident is therefore known only through the group’s leak-site claim and the accompanying high-level summary.

Inside sarcoma

Sarcoma is a ransomware operation that follows the now-familiar double-extortion model: after gaining access to a network, operators typically exfiltrate data and then encrypt systems, threatening to publish the stolen material if payment is not made. The group maintains a dedicated leak site on which it names victims and, in some cases, posts sample files or full archives. Like other contemporary ransomware crews, sarcoma has targeted a range of mid-sized enterprises across manufacturing, distribution and professional services. Its listings are public claims; they do not by themselves constitute independent verification that a breach occurred or that every asserted detail is accurate. In the present case the only assertion tied specifically to Decoline is the listing itself and the statement that internal files were taken.

Decoline and its sector

Decoline has operated since 1990 as a producer and distributor of curtain-hanging systems and complete professional window-decoration solutions. The company emphasises product innovation and quality standards and positions itself as a leading player in the European window-decoration market. At the end of 2019 it was acquired by the investment group Renardmont, which allowed it to continue as an independent entity focused on growth. Firms of this type typically maintain design drawings, production specifications, supplier contracts, customer order histories, pricing data, employee records and logistics information. Because window-decoration products are installed in residential and commercial buildings, the company also sits at the intersection of manufacturing, wholesale distribution and project-based supply chains. A breach affecting such an organisation can therefore touch both operational continuity and the commercial relationships that sustain it.

What data was at risk

The sole description available is “internal files exfiltrated in ransomware attack.” No inventory of those files has been published, nor has any confirmation been given of whether personal data, financial records, intellectual property or customer information formed part of the haul. Organisations in the window-decoration and light-manufacturing sector commonly hold employee contact and payroll details, customer and installer contact lists, order and invoice data, product designs, and supplier agreements. Whether any of these categories were present among the files claimed by sarcoma remains unconfirmed. Until Decoline or an independent investigation provides a fuller accounting, the precise contents must be treated as unknown.

Why it matters

For individuals whose details may have been stored in Decoline’s systems—employees, installers, wholesale customers or end clients—the practical risks include phishing that leverages authentic-looking company correspondence, social-engineering attempts that reference real orders or projects, and, in rarer cases, identity-related fraud if personal identifiers were present. For the company itself, the exposure of internal files can reveal pricing strategies, production methods or contractual terms to competitors, and can erode trust among supply-chain partners who rely on confidentiality. Because the scale of the incident is undisclosed, the breadth of these risks cannot yet be quantified; the absence of confirmed numbers does not eliminate the possibility of targeted misuse of any data that was taken.

What to do if you're exposed

Anyone who has worked with, supplied or purchased from Decoline should treat unsolicited emails or calls that reference the company with extra caution and verify them through known channels. Monitor financial and credit statements for unusual activity, and consider placing fraud alerts with relevant credit agencies if personal identifiers were ever shared with the firm. Change passwords on any accounts that reused credentials associated with Decoline-related services, and enable multi-factor authentication wherever possible. Readers can also run a free exposure scan of their email address against known breach datasets to check whether their information has already appeared in public dumps. If Decoline issues further guidance or a formal notification, follow the steps it recommends; until then, the measures above remain the most practical first response.

AICompiled with AI assistance from public sources and published under our editorial standards.