Skip to content
Leak-site post naming Thermofin, captured by ThreatCluster

Thermofin

sarcoma

Ransomware leak-site victim intelligence

Data size
2.9 TB Archive
Files
32
Views
68,797
Posted
Sep 23, 2025
Country
Germany
Industry
Building Materials

Summary

Written by ThreatClusterfrom victim profile, leak post

The sarcoma group states they published a 2.9 TB archive related to Thermofin (thermofin.de), a German building materials company. The leak page lists Thermofin as the victim and includes the victim profile: domain thermofin.de, sector Building Materials, country Germany. The leak post is published.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

Thermofin GmbH specializes in innovative and high-performance cooling solutions for various industries, including industrial refrigeration and air conditioning. Their product range includes evaporators, air coolers, heat pumps, and hybrid chillers, designed to cater to both commercial and industrial clients. Established in 2002, the company has continually expanded its production capabilities and invested in creating new jobs. With a commitment to quality management and technical expertise, Thermofin serves a broad customer base while maintaining a focus on sustainable growth and employee development.

File types seen
zip × 32
Sample files (32)
Thermofin_20250919_045141_part001_large.zip
Thermofin_20250919_045141_part002.zip
Thermofin_20250919_045141_part003.zip
Thermofin_20250919_045141_part004.zip
Thermofin_20250919_045141_part005.zip
Thermofin_20250919_045141_part006.zip
Thermofin_20250919_045141_part007.zip
Thermofin_20250919_045141_part008.zip
Thermofin_20250919_045141_part009.zip
Thermofin_20250919_045141_part010.zip
Thermofin_20250919_045141_part011.zip
Thermofin_20250919_045141_part012.zip
Thermofin_20250919_045141_part013.zip
Thermofin_20250919_045141_part014.zip
Thermofin_20250919_045141_part015.zip
Thermofin_20250919_045141_part016.zip
Thermofin_20250919_045141_part017.zip
Thermofin_20250919_045141_part018.zip
Thermofin_20250919_045141_part019.zip
Thermofin_20250919_045141_part020.zip
Thermofin_20250919_045141_part021.zip
Thermofin_20250919_045141_part022.zip
Thermofin_20250919_045141_part023.zip
Thermofin_20250919_045141_part024.zip
Thermofin_20250919_045141_part025.zip
Thermofin_20250919_045141_part026.zip
Thermofin_20250919_045141_part027.zip
Thermofin_20250919_045141_part028.zip
Thermofin_20250919_045141_part029.zip
Thermofin_20250919_045141_part030.zip
Thermofin_20250919_045141_part031.zip
Thermofin_20250919_045141_part032.zip

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

notes
Thermofin data appears as 32 zip parts with sizes listed in the directory listing.

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture