Ransomware gang says it hacked Manchester Credit Union

Ransomware gang Sarcoma today claimed responsibility for a cyber attack against Manchester Credit Union in the UK.

MCU announced technical difficulties with its inbound payment system on April 3, 2025. In response to Comparitech’s questions, MCU called the hack a “failed ransomware attack” and says no customer data appears to be compromised. While recovery efforts were underway, 21 team members were affected by two days of downtime, the firm says, and the attack did wipe some MCU servers. According to the credit union, the attackers did not demand a ransom.

MCU has not verified Sarcoma’s claim. Sarcoma gave MCU just over one week to pay an undisclosed sum in ransom, or else it will auction or release allegedly stolen data. We do not know how attackers attempted to breach MCU’s network or to what extent its attack succeeded.

When asked how attackers infiltrated MCU’s systems, the company responded, “Unsure as it was a failed attempt, with them taking the only available course of action available to them and wiping the servers, making investigation almost impossible.” [sic]

Who is Sarcoma?

Sarcoma is a fairly new ransomware group that first started claiming responsibility for attacks in October 2024. Its initial attack vectors including phishing emails and vulnerability exploits.

Sarcoma claimed responsibility for 14 confirmed ransomware attacks to date, plus another 78 unconfirmed claims that haven’t been acknowledged by the attacked organizations. In 2025, its only other confirmed attack so far was against Unimicron Technology in Shenzhen, China.

In 2024, Sarcoma hit two other finance companies: Advanced Accounting & Business Advisory in New Zealand, and Popular Life Insurance Company in Bangladesh.

Ransomware attacks on finance

Ransomware attacks on finance businesses can steal data and lock down computer systems. Businesses must then pay a ransom or face data loss, extended downtime, and putting data subjects at increased risk of fraud.

In 2025 so far, Comparitech researchers logged 16 confirmed ransomware attacks on finance companies worldwide. Another 138 unconfirmed claims haven’t been acknowledged by the targeted firms.

Other recent such attacks include:

About Manchester Credit Union

Manchester Credit Union was founded in 1991 in the UK and now serves more than 32,000 members. It employs fewer than 50 people, according to MCU’s LinkedIn profile.