IAD GmbH Listed by sarcoma Ransomware Group

On September 17, 2025, German training and certification company IAD GmbH appeared on the leak site of the sarcoma ransomware group. The attackers published a 43 GB archive containing internal files, SQL databases, and Exchange data after the company failed to meet their demands.

Reported Details of the Breach

Public reporting indicates the incident began as a ransomware attack in which sarcoma exfiltrated data before encrypting systems. The leaked material includes business files, database exports, and email server contents from IAD GmbH, which operates Pearson VUE test centers in Erfurt, Jena, Leipzig, Marburg, and Nordhausen. The group gave the company a deadline to pay or face full publication; when that deadline passed, the 43 GB archive was posted on their leak site.

At present the exact number of individuals whose information appears in the archive remains unknown. The data types exposed suggest that employee records, partner contracts, customer booking details, and internal communications may have been included.

Why This Matters for You and Your Family

When a company like IAD GmbH loses control of SQL databases and Exchange mailboxes, the information inside can be used to target anyone who trained there, took a certification exam, or had their details stored as a client or employee. Names, addresses, dates of birth, email accounts, and phone numbers are common in such leaks and can be combined with other publicly available data to build a complete profile.

Once that profile exists, it can be sold on underground forums or used directly against you. Criminals may attempt account takeovers on personal email, banking, or government services. Children are not automatically protected; family-linked records can expose minors’ names and locations, which then appear in gaming accounts or school-related documents.

The Doxxing and Identity-Chain Risk

A single breach rarely stays isolated. Attackers map connections between work email, personal handles, phone numbers, and family members. One leaked Exchange address can reveal your username on other services. That username, once tied to your real identity, can unlock children’s gaming accounts that reuse similar credentials. The result is an identity chain that leads from a professional training provider in Germany to your home address and your family’s online lives.

Credential leaks like this one cascade into account takeovers and doxxing chains. What begins as a corporate ransomware incident can end with harassment, identity theft, or targeted scams against you or your children.

Sarcoma Ransomware Group’s Track Record

Public reporting attributes the attack to the sarcoma ransomware group. The group emerged in early 2024 and has since listed dozens of victims, primarily small and mid-sized businesses across Europe and North America. Notable prior targets include logistics firms, manufacturers, and professional service providers. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by data exfiltration, encryption of systems, and extortion via dual pressure: ransom payment to decrypt files and a separate fee to prevent publication on their leak site.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used at IAD GmbH or any related training portal, then enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests for any exposed personal documents or broker listings that surface from this incident.

The breach of IAD GmbH is a reminder that corporate ransomware attacks now routinely expose ordinary families. Taking concrete steps now limits how far attackers can travel along your identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts.