Miller & Stewart Listed by Sarcoma Ransomware Group

On June 4, 2025, the accounting and tax firm Miller & Stewart appeared on the leak site of the sarcoma ransomware group. Public reporting indicates the attackers exfiltrated internal files during a ransomware incident and have now published a sample of the stolen data.

Reported Details of the Breach

Available reporting describes the incident as a classic ransomware operation in which the group first gained access, encrypted systems, and then exfiltrated documents before demanding payment. The exact number of people whose information was taken remains unknown, but the firm’s own description of its work shows it handles sensitive tax returns, financial records, and personal client documentation. The data posted on the sarcoma leak site includes samples of these internal files. No confirmed timeline for the initial intrusion has been released, though ransomware groups typically exfiltrate data weeks or months before listing victims.

Why This Matters for You and Your Family

If you or anyone in your household has ever used Miller & Stewart for tax preparation, bookkeeping, or financial advice, your personal information may now sit in a ransomware database. Tax returns, Social Security numbers, bank details, and correspondence are common contents of accounting firm records. Once that material reaches criminal networks, it can be sold, traded, or used to file fraudulent tax returns in your name. Children listed as dependents on those returns are also exposed, creating long-term risks for identity theft that can follow them into adulthood.

The Doxxing and Identity-Chain Risks

A single breach rarely stays isolated. Tax documents often contain addresses, phone numbers, email accounts, and employer details that attackers combine with login credentials stolen elsewhere. This creates an identity chain: one leaked email leads to a reused password on a shopping site, which leads to a gaming account, which reveals even more personal connections. Public reporting shows these chains frequently end in doxxing, harassment, or targeted fraud against entire households. Gaming accounts belonging to you or your children are especially vulnerable because kids often reuse simple passwords or email addresses tied to family tax records.