Curtidos Barbero Listed by Sarcoma Ransomware Group

On October 9, 2024, Spanish leather wholesaler Curtidos Barbero appeared on the leak site operated by the sarcoma ransomware group. The listing states that the company’s internal files were exfiltrated during a ransomware attack. The notification does not disclose the number of records affected, the specific types of documents taken, or any ransom demand.

Details from the Leak-Site Listing

The sarcoma leak site entry states that Curtidos Barbero suffered a ransomware incident and that attackers successfully removed internal files. No sample data has been published so far, and the listing does not quantify the volume or sensitivity of the material. The disclosure indicates the data was taken prior to the public posting on October 9. Ransomware.live mirrors the original sarcoma page, preserving the exact claim that internal files were exfiltrated.

Like most ransomware operators, sarcoma typically uses the initial posting as leverage to pressure the victim into payment before any material is released publicly. Whether sarcoma will publish additional proof or samples remains unknown at this time.

Why This Matters for You and Your Family

When a company that has served customers since 1940 has its internal files stolen, anyone who ever bought leather goods, placed a wholesale order, or supplied materials to Curtidos Barbero could be indirectly exposed. Business records frequently contain names, addresses, phone numbers, email accounts, order histories, and payment details. If your information appears in those files, it can be combined with data from other breaches to build a detailed profile.

Even when record counts are unknown, the real-world risk is concrete: identity thieves and fraudsters buy these datasets in bulk. One exposed email and phone combination is often enough to trigger account-reset attacks on personal banking, email, or government portals that your family relies on.

The Doxxing and Identity-Chain Risk

Stolen internal files rarely stay isolated. Attackers map relationships between company contacts, personal email addresses, phone numbers, and sometimes home addresses. These links create identity chains that stretch from a single B2B transaction into your household. A supplier’s spreadsheet can reveal not only your ordering habits but also delivery addresses that tie directly to family members.

Credential leaks that surface in the same datasets often cascade into gaming accounts. Children’s usernames, linked email addresses, and reused passwords become entry points for doxxing, harassment, or further extortion. Once an attacker controls one account tied to your address or family name, the rest of the chain collapses quickly.

Sarcoma Ransomware Group’s Track Record

Public reporting attributes sarcoma to a relatively new ransomware operation that began advertising victims in mid-2024. The group follows a double-extortion model: encrypt systems where possible, exfiltrate documents, then threaten to publish the data unless payment is made. Notable prior victims listed on their site include small-to-medium manufacturers and distributors across Europe and Latin America. Their typical playbook relies on phishing or compromised remote-desktop credentials for initial access, followed by rapid data theft and quiet extortion rather than loud public shaming campaigns.

The group’s leak site remains active, and new victims continue to appear weekly. Exact tactics can shift, but the core pattern—steal first, negotiate later—has stayed consistent in available public reporting.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including any ties to suppliers like Curtidos Barbero.
• Rotate passwords used with Curtidos Barbero or any related supplier accounts anywhere they are reused, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that can chain back to the same leaked address or contact details.
• Let remediation specialists handle ongoing takedown requests for any personal data that surfaces from this or linked incidents.

The breach of Curtidos Barbero shows how even long-established local businesses can become gateways to personal exposure. Acting quickly on the credentials and contact details already circulating limits how far attackers can travel down the identity chain. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage give you and your family a practical defense against both this incident and the ones that will follow.