Skip to content
Leak-site post naming Söllner, captured by ThreatCluster

Söllner

sarcoma

Ransomware leak-site victim intelligence

Data size
286 GB Archive
Files
2
Views
68,514
Posted
Nov 20, 2025
Country
Germany
Industry
Commercial & Residential Construction

Summary

Written by ThreatClusterfrom victim profile, leak post

The sarcoma group claims to have stolen and published a 286 GB archive from Söllner, identified by the domain bedachungen-soellner.de. The victim is described as a German commercial and residential construction firm. The leak post is marked as published.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

Söllner GmbH & Co. KG is a family-owned roofing company based in Plettenberg, operating for four generations since 1902. The company specializes in roofing, carpentry, facade construction, scaffolding, and offers additional services such as container service and crane rentals. Recently, they have expanded into architecture, providing comprehensive services from design to execution. With a team of qualified professionals, Söllner serves both regional and national clients in the industrial, commercial, public, and private sectors

File types seen
zip × 2
Sample files (2)
Files.zip
SQL.zip

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

label
Index of /
SQL.zip
20-Nov-2025 08:44 19296471609
Files.zip
20-Nov-2025 10:20 285547559402

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture