Skip to content
Leak-site post naming Paul Hildebrandt, captured by ThreatCluster

Paul Hildebrandt

sarcoma

Ransomware leak-site victim intelligence

Data size
1,4 TB Archive
Files
10
Views
64,189
Posted
Nov 11, 2025
Country
Germany
Industry
Manufacturing

Summary

Written by ThreatClusterfrom victim profile, leak post

The group sarcoma claims to have stolen and published a 1.4 TB archive from hildebrandt.de, linked to Paul Hildebrandt. The materials are described as HR and recruitment records, internal documentation and source code. The leak post is published and identifies the victim as Paul Hildebrandt, with hildebrandt.de listed as the domain in the German manufacturing sector.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

Paul Hildebrandt AG is a leading packaging company offering over 50,000 products, including environmentally friendly options. With 300 employees across 14 locations in Germany, Austria, and Denmark, they provide tailored packaging solutions for a variety of industries. The company emphasizes sustainability and efficient packaging processes as part of their commitment to client solutions. Their diverse product range includes films, boxes, adhesive tapes, and various packaging materials.

File types seen
zip × 10
Sample files (10)
Exchange.zip
Files0.zip
Files1.zip
Files2.zip
Files3.zip
Files4.zip
Files5.zip
Files6.zip
Files7.zip
SQL.zip

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture