Skip to main content
Darkfield

Ransomware victim disclosure

← All victims

Baker Tilly Morrison Murray

Claimed by Sarcoma · listed 2 years ago

516 GB
Data size
$3.8B
Ransom
demanded
18m
Age
since listed · data leaked

Status timeline

  1. ListedDec 24, 2024
  2. Data leakeddate unknown

At a glance

Group
Sarcoma
Status
Data leaked
Country
South Africa
Sector
Business Services
Listed on leak site
Dec 24, 2024
Data size
516 GB
Ransom demanded
$3.8B

About the victim

AI dossier — public-source company profile

Baker Tilly Morrison Murray is one of South Africa's oldest and largest independent auditing, accounting and advisory firms, established in 1914 and based in Durban. As an independent member of Baker Tilly International (the world's 8th largest accountancy network), the firm provides comprehensive auditing, assurance, tax, and business advisory services to clients across South Africa and internationally.

Industry
Accounting & Auditing Services
Address
Westville, Durban, South Africa
Founded
1914

Attack summary

Severity: critical — Confirmed exfiltration of 516 GB of data from a major accounting and audit firm, exposing highly sensitive client financial records, tax information, and business data at scale. The volume and nature of data (accounting firm records) implies exposure of regulated financial and potentially personal information of numerous clients.

The Sarcoma group claims to have exfiltrated 516 GB of data from Baker Tilly Morrison Murray, including files and SQL databases. The group has published the data and is reportedly demanding $3.8 billion in ransom.

critical

Data the group says was taken

AI dossier — extracted from the leak post
  • Client financial records
  • SQL databases
  • Business files
  • Audit working papers
  • Tax documentation
  • Client account information

What the group claims

Baker Tilly Morrison Murray Baker Tilly Morrison Murray is a firm of Registered Auditors and Chartered Accountants situated in Westville, Durban, South Africa. Baker Tilly Morrison Murray traces its roots back to 1914 and the firm has established itself as a niche player in the local market, offering comprehensive auditing and business advisory services. The firm is an independent member of Baker Tilly International. Baker Tilly International is a leading global network of high quality, independent accountancy and business advisory firms united by a commitment to provide exceptional client service. Baker Tilly International is the world’s 8th largest accountancy and business advisory network by combined fee income of its independent members. It is represented by 165 member firms in 141 countries with combined fee income of US$3.8bn and more than 28,000 people worldwide. Through our membership of Baker Tilly International, we are able to provide premier accounting, assurance, tax and specialist business advice worldwide, drawing on internationally recognised industry and service line experts in 141 countries. Each of the network’s 165 member firms is independent and autonomous; however, we have chosen to work together, resulting in strong professional relationships and efficient collaboration. Baker Tilly International member firms demonstrate a high professional standard, as well as a strong commitment to the network’s core values of integrity, leadership, transparency and ethics. Each member firm offers outstanding personal service combined with the expertise, strength and resources of a truly global network to support you as you grow regionally and globally.Geo: ZA/USA - Leak size: 516 GB Archive - Contains: Files, SQL

Sources

Source

Indexed 2 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About Sarcoma

Sarcoma is a relatively new ransomware group that emerged in October 2024, operating with apparent financial motivations and demonstrating a broad international targeting approach with at least 140 documented victims across multiple countries and industry sectors. The group's origin and affiliations remain unclear due to its recent emergence, with no publicly documented connections to established ransomware families or confirmation of whether they operate as an independent entity or through a Ransomware-as-a-Service model. Limited public information is available regarding Sarcoma's specific attack methodologies, initial access vectors, or technical capabilities, though their targeting patterns suggest opportunistic rather than highly selective victim selection across diverse industries including manufacturing, business services, agriculture and food production, and technology sectors. The group has shown a particular focus on victims in the United States while also maintaining operations against targets in Italy, Canada, Germany, and Australia, though no specific high-profile attacks or record ransom demands have been publicly documented by major security firms or law enforcement agencies. Given the group's recent emergence in late 2024, Sarcoma appears to remain active with no reported law enforcement disruptions or confirmed rebranding activities at this time. The group has been linked to 150 public disclosures across our corpus. First observed on a leak site on October 9, 2024; most recent post May 12, 2026. The operation is currently active.

Also tracked as: Sarcoma Ransomware Group.

Timeline of this disclosure

  • December 24, 2024Baker Tilly Morrison Murray listed by Sarcomaon the group's public leak site
Data size
516 GB
Ransom demanded
$3.8B

Other recent disclosures by Sarcoma

Sarcoma has been linked to 150 public victims on Darkfield. A sample of the most recent:

See the full Sarcoma dossier →

Sector and geography

This disclosure adds to ransomware activity in the Business Services sector, which has 3,796 disclosures indexed across all operators we track. Geographically, Baker Tilly Morrison Murray is reported in South Africa, a country with 52 ransomware disclosures in our corpus.

If your organisation is affected

A listing by Sarcoma means Baker Tilly Morrison Murray appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

  • Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
  • Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
  • Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
  • Report the incident to your national CERT, ECS-CSIRT (South Africa), as required for your jurisdiction.
  • Monitor for the data appearing on Sarcoma's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.