Harinera del Valle Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized manufacturers and food producers across Latin America, using double-extortion tactics that combine encryption with the threat of public data leaks. In this environment, even listings that remain unverified can create lasting uncertainty for employees, suppliers and customers whose information may have been taken.

On 6 August 2025 the ransomware group sarcoma listed Harinera del Valle, a long-established Colombian food company, on its leak site and claimed to have exfiltrated a 59 GB archive of internal files. The number of people affected is unknown, and independent confirmation of the claim has not been published. The incident matters because organisations of this type routinely hold operational, commercial and personal data whose exposure can affect both the business and the individuals connected to it.

What happened

Public reporting states that Harinera del Valle was listed by the sarcoma ransomware group on 6 August 2025. The group claims that internal files were exfiltrated during a ransomware attack and that the resulting archive measures 59 GB. No further technical details—such as the initial access vector, the encryption status of systems, or the precise date of intrusion—have been disclosed. The number of individuals whose data may be involved remains unknown. At present the listing itself constitutes an unverified claim by the threat actor rather than a confirmed forensic finding.

The group behind it: sarcoma

Sarcoma is a ransomware operation that follows the now-common double-extortion model: after gaining access, operators encrypt systems and simultaneously steal data, then threaten to publish the stolen material on a dedicated leak site if a ransom is not paid. The group typically advertises victims with brief descriptions and file-size claims, using the publicity to increase pressure. Public reporting on sarcoma’s earlier activity shows a pattern of targeting organisations across multiple sectors and geographies, with leak-site posts serving as the primary public signal of an incident. In the present case the group claims that Harinera del Valle’s internal files were taken; no independent verification of that specific claim has been released.

Harinera del Valle and its sector

Harinera del Valle is a Colombian company with more than sixty years of experience producing and commercialising processed foods. Its portfolio includes oils, flours, pastas and ready-to-eat meal mixes sold under brands such as Haz de Oros and Doarepa, serving both household and business customers in the food sector. Food manufacturers of this scale typically maintain extensive operational records, supplier contracts, distribution data, employee information and customer-related files. A breach involving such an organisation is consequential because disruptions or data exposure can affect supply chains, employee privacy and the trust of commercial partners who rely on the company’s products.

The information in question

The only data type named in public reporting is “internal files” said to have been exfiltrated. The exact contents of the claimed 59 GB archive have not been disclosed. Organisations in the food-manufacturing sector commonly hold employee personnel records, payroll data, supplier and customer contact details, production schedules, quality-control documentation and commercial contracts. Whether any of these categories are present in the material claimed by sarcoma remains unconfirmed. Public detail is therefore limited to the group’s assertion that internal files were taken.

The real-world impact

If the claimed archive contains personal or commercial information, affected individuals could face risks of phishing, identity misuse or unwanted contact. Employees might see payroll or contact details circulated; suppliers and business customers could find contractual or pricing information exposed. For the company itself, the incident may generate operational disruption, reputational questions and the need to notify regulators or partners under applicable Colombian data-protection rules. Because the precise contents and the number of people involved remain unknown, the full scope of these risks cannot yet be quantified. The listing alone, however, already creates a period of uncertainty that organisations and individuals must manage carefully.

Were you affected?

Anyone who has worked for, supplied or done business with Harinera del Valle should treat the possibility of exposure seriously until more information becomes available. Practical first steps include:

• Monitor bank and credit-card statements for unexpected activity.
• Enable multi-factor authentication on email and other important accounts.
• Be alert to phishing messages that reference the company or recent events.
• Request a free credit report if you are a Colombian resident and review it for unfamiliar entries.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

If you receive confirmation that your data was involved, follow any official guidance issued by the company or by Colombian data-protection authorities. Until such confirmation arrives, the most useful posture is measured vigilance rather than alarm.

AICompiled with AI assistance from public sources and published under our editorial standards.