Baker Tilly Morrison Murray
bd_24cc28353e3510d0 · schema v1 · pii pii-v1
Full breach record for Baker Tilly Morrison Murray →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Sarcoma on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Baker Tilly Morrison Murray Baker Tilly Morrison Murray is a firm of Registered Auditors and Chartered Accountants situated in Westville, Durban, South Africa. Baker Tilly Morrison Murray traces its roots back to 1914 and the firm has established itself as a niche player in the local market, offering comprehensive auditing and business advisory services. The firm is an independent member of Baker Tilly International. Baker Tilly International is a leading global network of high quality, independent accountancy and business advisory firms united by a commitment to provide exceptional client service. Baker Tilly International is the world’s 8th largest accountancy and business advisory network by combined fee income of its independent members. It is represented by 165 member firms in 141 countries with combined fee income of US$3.8bn and more than 28,000 people worldwide. Through our membership of Baker Tilly International, we are able to provide premier accounting, assurance, tax and specialist business advice worldwide, drawing on internationally recognised industry and service line experts in 141 countries. Each of the network’s 165 member firms is independent and autonomous; however, we have chosen to work together, resulting in strong professional relationships and efficient collaboration. Baker Tilly International member firms demonstrate a high professional standard, as well as a strong commitment to the network’s core values of integrity, leadership, transparency and ethics. Each member firm offers outstanding personal service combined with the expertise, strength and resources of a truly global network to support you as you grow regionally and globally.Geo: ZA/USA - Leak size: 516 GB Archive - Contains: Files, SQL
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Dec 24, 2024
Claim posted
—
No filing yet · watching
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
No regulatory filing corroborates this yet — it is the attacker's own assertion. Watch this entity to be notified the moment a filing corroborates or contradicts it.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
sarcoma
According to ransomware.live, Sarcoma is a ransomware group that debuted in October 2024, immediately ranking among the top three most active groups globally and surpassing 116 documented victims by mid-2025, targeting mid-market companies across manufacturing, retail, healthcare, legal, and business services with roughly 50% of victims in the United States.