Baker Tilly Morrison Murray Listed by Sarcoma Ransomware Group

On December 24, 2024, South African accounting firm Baker Tilly Morrison Murray appeared on the leak site of the sarcoma ransomware group in a listing claiming internal files were exfiltrated during a ransomware attack.

What Public Reporting Shows

Public reporting indicates the firm, based in Westville, Durban, was listed by the sarcoma group on its leak portal. The company, which traces its roots to 1914, provides auditing and business advisory services and operates as an independent member of Baker Tilly International. Available reporting describes the incident as a ransomware attack in which internal files were allegedly stolen. The exact number of people whose data may have been exposed remains unknown, and the specific types of records taken have not been publicly detailed beyond the broad description of internal files. No deadline for payment or further data publication has been confirmed in available sources.

Why This Matters for You and Your Family

When an accounting firm suffers a breach, the information at risk often includes tax returns, financial statements, identity documents, and correspondence that contain your full name, address, date of birth, tax identification numbers, and banking details. These records can be used to file fraudulent tax returns, open accounts in your name, or impersonate you with government agencies. If you or your family have ever used Baker Tilly Morrison Murray for auditing, tax preparation, or business advice, your personal and financial data may now sit in an attacker’s archive. Children’s records are sometimes included in family tax files, creating long-term risks that extend beyond your own identity.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently contain email addresses, phone numbers, and client references that link multiple online handles to real-world identities. Attackers can combine this information with data from earlier breaches to build detailed profiles. Credential leaks like this one often cascade into gaming account takeovers, where children’s usernames and passwords are reused across platforms, exposing chat logs, location data, and family photos. Once a chain is established, doxxing escalates quickly from leaked tax documents to targeted harassment or identity theft that affects every member of the household.

What to Do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity, with cleanup of exposed records.
• Rotate any password you ever used at Baker Tilly Morrison Murray and enable two-factor authentication through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours rather than months.
• Cover the entire household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address and identity details.
• Let remediation specialists handle takedown requests across data brokers and exposed databases on your behalf.

The sarcoma group’s appearance on this incident adds another public example of how ransomware operators move from encryption to extortion by threatening to publish sensitive client data. While the full scope of the Baker Tilly Morrison Murray breach may never be known, the pattern is clear: once files leave the victim’s control, they can surface anywhere. A short forward-looking step is to treat every accounting relationship as a potential exposure point and act immediately rather than waiting for confirmation that your records were taken. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered handles to your real identity, hands-on remediation by specialists, and full household coverage that includes your children’s gaming accounts.