Söllner Listed by Sarcoma Ransomware Group

On November 20, 2025, German family-owned roofing company Söllner GmbH & Co. KG appeared on the leak site of the sarcoma ransomware group. The attackers published a 286 GB archive of internal files stolen during a ransomware incident, exposing the small business and everyone whose personal information was stored in its systems.

Reported Details of the Breach

Public reporting indicates that Söllner, a four-generation company founded in 1902 and based in Plettenberg, Germany, was hit by a ransomware attack. The sarcoma group exfiltrated 286 GB of internal files before encrypting systems or demanding payment. The data was later posted to the group’s leak site, as documented on ransomware.live.

Available reporting describes the exposed material as internal company files. Exact contents have not been independently verified by third parties, but typical ransomware leaks at companies of this size often include customer records, employee details, contracts, invoices, and correspondence. No confirmed count of affected individuals has been released.

Why This Matters for You and Your Family

When a local business like a roofing contractor suffers a breach, the impact reaches far beyond the company. If you or your family have ever hired Söllner for roof repairs, scaffolding, crane rental, or architectural services, your name, address, phone number, email, payment details, or project information may now sit in a 286 GB publicly downloadable archive.

That data does not stay isolated. Once posted on a ransomware leak site, it circulates quickly among identity thieves, phishing gangs, and doxxers who combine it with other leaks. For ordinary families this can mean sudden spam, impersonation calls, or targeted scams that feel personal because the attackers already know where you live and what work was done on your house.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one company’s files. A single exposed invoice can link your home address to an email address, which links to a username used on gaming platforms or social media. Attackers follow these chains to build full profiles. Public reporting shows this pattern repeatedly: initial leaks cascade into account takeovers, swatting attempts, or extortion targeting family members.

Children’s gaming accounts are especially vulnerable. A parent’s reused email or password from a contractor’s records can hand attackers the keys to a child’s Fortnite, Roblox, or Discord account. Once inside, they can harvest friends lists, IP addresses, and chat logs, turning a business breach into direct harassment of your household.

Sarcoma Group’s Known Track Record

Public reporting attributes the attack to the sarcoma ransomware group. The group emerged in recent years and has targeted organizations across multiple countries with a classic double-extortion playbook: they steal data before encrypting systems, then threaten to publish it unless ransom is paid. Notable prior victims include other small-to-medium businesses whose internal files were posted on dedicated leak sites when negotiations failed. Their typical approach involves initial access through common vectors such as phishing or unpatched remote desktop services, followed by claimed exfiltration of documents and aggressive public shaming on their leak portal.

What to do

• Rotate any password you have ever used when dealing with Söllner or similar local contractors, and enable 2FA with an authenticator app on every account where that password was reused.
• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you is flagged within hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and credentials.
• Let DoxxScan remediation specialists manage takedown requests across data brokers and exposed records on your behalf.

The sarcoma leak of Söllner’s 286 GB archive is a reminder that small local businesses hold data that directly affects your daily life. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel along the chain that begins with this incident. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full family and household coverage including children’s gaming accounts. Start your DoxxScan trial today to close the gaps this claimed breach has opened.