On October 9, 2024, the EARTHWORKS Group, Inc. appeared on the leak site operated by the sarcoma ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the southeastern engineering and environmental consulting firm. The sarcoma operators have not yet published any samples, and the leak-site entry does not quantify how many records were taken or name the specific systems compromised.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch EARTHWORKS Group
Get alerted the next time EARTHWORKS Group files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about EARTHWORKS Group’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Reported Details from the Listing
The primary disclosure on the sarcoma leak site states that EARTHWORKS Group suffered a ransomware incident resulting in data exfiltration. No victim count is provided, and the exact data types remain undisclosed beyond the general description of internal files. The notification does not specify the date the intrusion occurred or any ransom demand. Public views of the sarcoma page, tracked through ransomware.live, show the entry first surfaced on October 9, 2024. The firm, founded in 1996, provides engineering, architectural, environmental, land planning, and related consulting services across the southeastern United States.
Why This Matters for You and Your Family
When a company that handles project plans, permitting documents, and client correspondence is breached, the information inside those files can easily include names, addresses, phone numbers, email addresses, and financial details tied to both business and personal projects. If your home, property, or small business has ever worked with an engineering or environmental firm in the Southeast, your information may be among the records now held by attackers. Even without an exact victim count, the exposure creates immediate risk because ransomware groups routinely use stolen data for identity theft, targeted phishing, or sale on underground markets. Your family’s privacy is directly affected the moment internal client files leave legitimate control.
The Doxxing and Identity-Chain Implications
Internal files from a planning and design firm frequently contain enough personal identifiers to link an individual’s real name and street address to online handles, email accounts, or even children’s school or recreational records. Attackers can chain these details with information from other breaches to build complete profiles. A single leaked environmental assessment or land-planning document might expose not only your contact information but also details about family members or household finances. Credential leaks that often accompany ransomware incidents can cascade into gaming-account takeovers, especially for children whose usernames and passwords are reused across platforms. Once attackers control a gaming account tied to the same household address, they can harvest additional personal data and escalate harassment or financial fraud.