Elmos Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by stealing data and threatening public release, a pattern that has become routine across Europe and beyond. Listings on criminal leak sites now serve as both leverage and advertisement, often appearing before any independent confirmation of what was taken or how the intrusion occurred.

On 26 March 2025 the ransomware group known as sarcoma listed Elmos, a Belgian organisation, claiming to hold 186 GB of internal material obtained in a ransomware attack. The number of people affected remains unknown, and public detail about the intrusion itself is limited. The listing matters because it signals that internal files may have left the organisation’s control and could surface online or be used for further fraud or extortion.

Inside the incident

According to the publicly reported listing, sarcoma claims to have exfiltrated internal files from Elmos during a ransomware attack. The group describes the material as a 186 GB archive containing files and SQL data. The listing was reported on 26 March 2025. No independent confirmation of the volume, exact contents, or method of access has been published in the available record. The number of individuals whose information may be involved is listed as unknown. Timing of the initial compromise, the encryption status of systems, and any ransom demand are undisclosed.

What is known is confined to the group’s own claim on its leak site: that internal files were taken and packaged for potential release. Beyond that assertion, public detail remains limited.

Inside sarcoma

Sarcoma is a ransomware operation that follows the now-common double-extortion model: encrypt systems where possible and, more importantly, steal data before or during the attack so that the threat of publication can be used to pressure victims. Groups of this type typically advertise victims on dedicated leak sites, post sample files or archive sizes, and set deadlines for payment. Public reporting on sarcoma has documented a pattern of targeting mid-sized organisations across multiple sectors, with data dumps that often include databases, internal documents and SQL exports.

In this case the group claims Elmos as a victim and lists a 186 GB archive of files and SQL. That claim has not been independently verified in the available facts; it should be treated as an unverified assertion by the threat actor rather than established fact. Sarcoma’s prior activity shows a preference for volume and breadth of stolen material rather than highly targeted, high-value intellectual property alone, but no specific statements by the group about Elmos beyond the listing itself are recorded here.

Who is Elmos?

Elmos presents itself as a Belgian organisation focused on information technology and people-oriented service. Its public description emphasises five-star service for employees and customers and an interest in building connections within its “Elmos family.” Organisations of this profile typically operate in professional services, IT support or related business-process functions and therefore hold employee records, customer contact data, contracts, internal operational files and databases that support day-to-day work.

A breach involving such an organisation is consequential because the data it holds is often personal, contractual or operational. Even when the precise contents of a leak remain unconfirmed, the combination of employee and customer information creates ongoing risk for the people whose details may have been taken and for the organisation’s ability to maintain trust and continuity.

What data was at risk

The available facts state that internal files were exfiltrated in a ransomware attack and that the claimed archive contains files and SQL data totalling 186 GB. No further breakdown of data types—such as names, contact details, financial records or credentials—is provided. The exact contents therefore remain unconfirmed.

Organisations of Elmos’s type commonly store employee personnel files, customer and supplier contact lists, invoices, project documentation, internal correspondence and database backups. SQL exports can contain structured records that are readily searchable or reusable by criminals. Because the listing does not itemise the files, it is not possible to state with certainty which of these categories, if any, are present. Readers should treat the exposure as potential rather than proven until more specific inventories appear.

What's at stake

For individuals whose information may be inside the archive, the practical risks include targeted phishing, identity fraud, credential stuffing against other accounts, and unwanted contact. Even partial records—names paired with email addresses or internal identifiers—can be enough for social-engineering attempts. For Elmos itself the stakes include regulatory notification duties under European data-protection rules, potential contractual liabilities toward customers and employees, reputational damage, and the operational cost of investigating and remediating the incident.

Because the number of affected people is unknown and the precise data types are not confirmed, the scale of harm cannot yet be quantified. The mere existence of a large claimed archive, however, means that both personal and organisational exposure must be treated seriously until the material is either verified as limited or shown to have been contained.

What to do if you're exposed

If you have a past or present relationship with Elmos—as an employee, customer or partner—monitor financial and email accounts for unusual activity, enable multi-factor authentication wherever it is offered, and treat unexpected messages that reference the company with caution. Change passwords on any accounts that may have shared credentials with work systems. Keep records of any suspicious contact so that you can report it to the relevant authorities or to Elmos’s own incident-response channel if one is published.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for understanding your wider digital footprint and deciding what further protective measures to take.

AICompiled with AI assistance from public sources and published under our editorial standards.