R&K Drysdales Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

R&K Drysdales, part of the East of Scotland Growers (ESG) group, was listed by the sarcoma ransomware group on or around 26 March 2025. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical details of the incident have not been disclosed.

The listing itself is a claim by the group. For an agricultural cooperative that works with growers across a wide area of Scotland, any confirmed exposure of internal material raises practical questions about operational continuity, commercial relationships and the personal or business data that such organisations typically hold.

What happened

According to available public information, R&K Drysdales was named on a sarcoma leak site with the assertion that internal files had been taken during a ransomware attack. The incident was reported on 26 March 2025. No confirmed figures have been released for the volume of data, the exact date of intrusion, the initial access method, or the number of individuals whose information may be involved. Public detail on whether systems were encrypted, whether a ransom demand was made, or whether any data has been released beyond the listing remains limited.

R&K Drysdales is described as part of the ESG group. East of Scotland Growers is a farmer-owned growing cooperative based in Cupar, Fife, established in 1987 and recognised by the European Union as a Producer Organisation. Its main crops include broccoli, Brussels sprouts and cauliflower, produced across a roughly 180-mile radius of fertile Scottish soils. The cooperative structure exists to give individual growers the benefits of collective scale.

The group behind it: sarcoma

Sarcoma is a ransomware operation that has appeared in public reporting as a group that combines encryption of victim systems with the exfiltration of data, a tactic commonly called double extortion. Groups of this type typically publish victim names on dedicated leak sites and threaten to release stolen material if payment is not made. Public knowledge of sarcoma’s broader activity includes listings of organisations across multiple sectors; the group’s claims are not independently verified at the moment of listing.

In this case, the only specific assertion tied to R&K Drysdales is the group’s claim that internal files were exfiltrated. No further statements attributed to sarcoma about this particular victim—such as sample file lists, ransom amounts, or deadlines—appear in the available facts. Readers should treat the listing as an unverified claim until the organisation or independent investigators confirm or refute it.

About R&K Drysdales

R&K Drysdales operates within the East of Scotland Growers cooperative. ESG was formed so that individual growers could pool resources, market produce collectively and meet the standards expected of a recognised Producer Organisation. The business is rooted in vegetable production—primarily brassicas and related crops—grown on Scottish land and supplied into commercial food chains.

Organisations of this kind routinely hold supplier and grower records, contracts, logistics data, financial information, employee details and correspondence with retailers or processors. A breach affecting internal files therefore has potential consequences not only for the cooperative’s own staff and members but also for the network of farms and commercial partners that rely on it. Because the cooperative model depends on trust and shared systems, disruption or data exposure can affect more than a single corporate entity.

What data was at risk

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data types—such as names, contact details, financial records, payroll, contracts or operational documents—has been published. The number of people affected is listed as unknown.

Agricultural cooperatives and grower organisations typically maintain records that can include personal data of employees and members, commercial agreements, production and logistics information, and banking or payment details. Whether any of those categories were among the files taken in this incident is unconfirmed. Until the organisation or a competent authority provides a clearer description, the exact contents of the exfiltrated material remain unknown.

What's at stake

For individuals whose information may have been held in internal systems, the practical risks include potential misuse of contact or identity details, targeted phishing that references genuine business relationships, and, if financial or contractual data were involved, attempts at fraud. Because the scale is undisclosed, it is not possible to say how many people fall into any of these categories.

For R&K Drysdales and the wider ESG cooperative, the stakes include operational disruption, the cost of investigation and recovery, possible regulatory notification duties, and damage to commercial confidence among growers and buyers. Even when encryption is reversed or systems are restored, the knowledge that internal files left the organisation can require long-term monitoring of supplier and customer relationships. None of these outcomes has been confirmed as having occurred; they are the ordinary consequences that follow ransomware claims of this type.

If your data was in this claimed breach

If you have a connection to R&K Drysdales, East of Scotland Growers, or related farming and supply-chain activity, the following steps are prudent while public detail remains limited:

• Treat unsolicited emails, calls or messages that reference the cooperative, crops, contracts or payments with extra caution; verify any request through a known official channel.
• Change passwords for accounts that may have been used in connection with the organisation, and enable multi-factor authentication where available.
• Monitor bank and credit activity for unexpected transactions if you have shared financial details with the cooperative or its members.
• Keep records of any suspicious contact and report clear fraud attempts to the relevant authorities.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; this can help you prioritise further monitoring.

Official confirmation of what was taken, and who is affected, has not yet been published. Until that information is available, measured vigilance is the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.