EP:Schuller Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure mid-sized organisations by combining encryption with data theft, then publicising victims on leak sites to force payment. These campaigns often hit family-run firms that hold operational and customer records, turning routine business data into leverage.

On 30 November 2024 the ransomware group sarcoma listed EP:Schuller on its site and claimed to have exfiltrated internal files during a ransomware attack. The number of people affected remains unknown. The listing itself is an unverified claim; public detail on the precise timing, entry method and full scope of the incident is limited. For customers and staff of a long-established family business, any confirmed exposure of internal material carries practical consequences that deserve clear, calm attention.

Breaking down the breach

According to the available record, EP:Schuller was listed by the sarcoma ransomware group on 30 November 2024. The group states that internal files were exfiltrated as part of a ransomware attack. No confirmed figure for the number of individuals affected has been published, and the exact date the intrusion began, the initial access vector and the volume of data taken have not been disclosed. The only concrete assertion in the public listing is that internal files left the organisation. Beyond that claim, further technical or forensic detail remains unconfirmed.

The group behind it: sarcoma

Sarcoma is a ransomware operation that follows the now-familiar double-extortion model: systems are encrypted while copies of data are stolen and used as additional pressure. When a ransom is not paid, the group typically posts the victim’s name on a dedicated leak site and may release samples or larger archives. Public reporting on sarcoma shows it has targeted organisations across several sectors, often mid-sized firms rather than global enterprises. Its listings are claims made by the actors themselves; independent verification of the volume or sensitivity of any particular haul is rarely available at the moment of publication. In this case the group asserts that EP:Schuller’s internal files were taken, but that assertion has not been independently confirmed in the supplied record.

EP:Schuller and its sector

EP:Schuller describes itself as a family business that has served customers for three decades, operating since 1989. It presents itself as “ENERGY STARS for our customers,” combining traditional craft values with progressive methods and new technologies. The organisation emphasises long-term customer relationships, quality workmanship and continuous development of its services. Businesses of this profile typically sit in energy-related services, installation or efficiency work—sectors that routinely handle customer contact details, project documentation, supplier contracts and internal operational files. A breach at such a firm is consequential because those materials can include both commercial secrets and personal information belonging to clients and employees, and because smaller family-run entities often lack the large security budgets of multinational corporations.

What was likely exposed

The public record names only “internal files” as having been exfiltrated. Exact contents, file counts and any personal-data categories remain undisclosed. Organisations of EP:Schuller’s type commonly hold material such as:

• Customer contact and project records
• Internal correspondence and operational documents
• Supplier and financial paperwork
• Employee-related administrative files

None of these categories has been confirmed as present in the stolen set; they are simply the kinds of data such a business would normally process. Until more detail emerges, any statement about specific personal identifiers or financial records would be speculation.

The real-world impact

For individuals whose information may have been among the internal files, the primary risks are unwanted contact, phishing attempts that reference genuine project details, or longer-term misuse of personal identifiers if those were present. For the organisation the consequences include potential disruption of day-to-day operations, the cost of investigation and remediation, and the need to notify customers and regulators where legal thresholds are met. Because the scale of the exfiltration is unknown, the precise number of people who should take protective steps cannot yet be stated. The listing itself can also damage commercial trust even before any data is shown to have been misused.

Were you affected?

If you have done business with EP:Schuller or worked for the firm, treat the possibility of exposure seriously but without panic. Change passwords on any accounts that reused credentials linked to the company, enable multi-factor authentication where available, and watch bank and credit statements for unusual activity. Be wary of unexpected emails or calls that appear to reference past projects. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official notifications from EP:Schuller or relevant authorities, if they are issued, should be followed carefully; until then, the practical steps above remain the most useful immediate response.

AICompiled with AI assistance from public sources and published under our editorial standards.