Söllner Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 20, 2025, the ransomware group sarcoma listed Söllner on its leak site and claimed to have taken 286 GB of internal files. No confirmation of the data’s contents or the number of individuals affected has been made public. This listing adds to the pattern of ransomware actors targeting established companies in Germany and elsewhere, where operational data can carry consequences for clients and employees even when the precise scope remains unknown.

What happened

Söllner was added to sarcoma’s leak site on November 20, 2025. The group claims to have exfiltrated an archive of 286 GB containing files during a ransomware operation. The number of people affected has not been disclosed, and no further details on the timing or method of the intrusion have been released by the company or investigators.

The group behind it: sarcoma

Sarcoma is a ransomware operation that follows the double-extortion model common among current threat actors. It typically encrypts systems and then publishes or threatens to publish stolen data on a dedicated leak site when ransom demands are not met. The group has appeared in multiple public listings involving organisations across Europe and North America, though each victim claim must be assessed individually.

Who is Söllner?

Söllner GmbH & Co. KG is a family-owned roofing and construction company based in Plettenberg, Germany. Founded in 1902, it provides roofing, carpentry, facade work, scaffolding, container services and crane rentals, and has recently added architectural design services. The firm serves industrial, commercial, public and private clients on a regional and national basis. Companies of this type routinely hold project documentation, client records, employee data and financial information required for construction contracts and regulatory compliance.

What was likely exposed

The only confirmed detail is that sarcoma claims to have removed internal files in a 286 GB archive. The precise categories of information contained in that archive have not been published or verified.

• Project and client documentation typical of a construction firm
• Employee and contractor records
• Financial and operational files

What's at stake

Exposure of construction-related files can reveal details about ongoing projects, pricing, supplier arrangements and site access information. For individuals, any personal data present could be used for identity-related fraud or targeted scams. For the company, the incident adds costs for investigation, potential regulatory notification and remediation even if the data’s sensitivity is later shown to be limited.

Were you affected?

Begin by monitoring official statements from Söllner and any required notifications under German data-protection rules. Change passwords for any accounts linked to the company and enable multi-factor authentication where available. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.