Reece Noland & McElrath Engineers Listed by Sarcoma Ransomware Group

On June 4, 2025, engineering firm Reece Noland & McElrath appeared on the leak site of the sarcoma ransomware group after attackers exfiltrated internal files during a ransomware incident. The Tennessee-based company, which provides HVAC, plumbing, electrical, and sustainable design services for schools, hospitals, and commercial buildings, has not publicly confirmed the number of individuals whose personal information may have been exposed.

What Public Reporting Shows

Public reporting indicates the firm was listed on the sarcoma ransomware leak site with samples of stolen data. The breach involved internal files exfiltrated after the group deployed ransomware. No exact victim count has been released by the company or the attackers. The incident follows the group’s standard pattern of stealing data before encrypting systems and then threatening to publish it unless a ransom is paid.

Why This Matters for You and Your Family

When a company that handles building projects for schools, medical facilities, or local governments is breached, the files often contain names, addresses, dates of birth, Social Security numbers, employee records, or client contracts. If your family has lived in a home designed or renovated by Reece Noland & McElrath, worked with them on a project, or had records stored in their systems, your information could be among the stolen data. Once files leave the company’s network, they can be sold, traded, or used to open accounts in your name. Children’s records are especially attractive because they often remain clean for years and can be exploited for synthetic identity fraud.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently include email addresses, usernames, phone numbers, and project notes that link digital handles to real-world identities. Attackers chain these fragments together: a work email leads to a personal account, which leads to a child’s gaming username, which reveals a home address. This identity-chain process turns one breach into long-term exposure. Credential leaks like this one regularly cascade into gaming account takeovers, where children’s profiles are hijacked for harassment or further data harvesting. Public reporting shows these chains accelerate doxxing campaigns that can last months or years.