Sarcoma's leak site, as indexed by ransomware.live on Oct. 23, 2026 (discovery 2026-10-23 11:48 UTC), names Don Pickett & Associates as a claimed victim of the Sarcoma ransomware group. That is a leak-site / tracker listing. It is not a company disclosure. Don Pickett & Associates has not confirmed or publicly commented on the claim.
The firm's own site, donpickett.com, describes Don Pickett & Associates as a family-owned corporation in Fresno, California, founded in August 1988, with in-house architectural design, drafting, and civil engineering, plus commercial and industrial design-build work. As of Oct. 26, 2026, we found no statement from the company confirming an incident, no regulator notice, and no press report of encryption, stolen project files, studio downtime, or a ransom payment. Treat the Sarcoma listing as an unverified claim until the firm says otherwise.
What's claimed, and what's confirmed
Claimed (unverified): Sarcoma's leak site, as indexed by ransomware.live on Oct. 23, 2026, lists Don Pickett & Associates. All of that is an actor assertion republished by a tracker. A leak-site listing is not proof of what was taken, whether any systems were encrypted, or whether any files were published.
Not confirmed: We have no company-confirmed encryption event, no confirmed theft of project, client, or employee data, no reported disruption to design or construction work, and no word on any payment. Do not invent those details from silence, and do not treat a tracker listing as proof that CAD files left the building.
Why it matters to architecture and civil engineering firms
A small architecture or civil office keeps the drawings, specs, survey files, and consultant correspondence that a job cannot restart without. Those stores also hold client names, subcontractor contacts, and sometimes a password typed into a shared folder "just for the consultant." If a leak-site listing is real, two problems follow. The first is rebuild time: can you restore this week's permit set from a copy that an attacker could not reach? The second is fraud that sounds like a job. An email that quotes a project name and asks a client or a steel fabricator to "use this new link for the latest drawings" is more convincing than a generic scam.
Even when the listing is only a claim, the phishing starts. Owners, civil consultants, and general contractors should expect messages about "updated plans," changed wiring instructions for a transfer, or a portal login to "confirm the submission." Architecture, civil, structural, and design-build shops across Rome, Northwest Georgia, metro Atlanta, Chattanooga, and the rest of Brotherly's footprint should treat this as a drill, not as a confirmed incident at a named Fresno firm.
Clear takeaway
Treat the Sarcoma leak-site claim against Don Pickett & Associates as a continuity and scam-hygiene drill for architecture and civil engineering offices — MFA on email, VPN, and design portals; restorable copies of drawings and CAD that sit off the live server; a list of every consultant who can reach the project store; and a rule that payment or drawing-link changes get a call-back. Do not treat the tracker post as proof that files were stolen, encrypted, or published.
Actions to take this week
- MFA on every path to the job files. Email, VPN or remote desktop, the CAD/project portal, and accounting. Shared "drafting" logins are the first thing to retire. Prefer an authenticator app or security key over text codes.
- Know which drawings you could restore tomorrow. Current CAD, PDF sets, specs, and survey files should have a copy that is not sitting on the same server, and you should test opening one active job from that copy. If you work with us on backup, that work is billed separately from managed IT; do not assume it is already included.
- List consultant and vendor remote access. Structural, MEP, civil, survey, and rendering consultants each get a named account with MFA, turned on for the job and turned off afterward. Review last month's remote-access log for accounts used outside a scheduled window.
- Get passwords out of project folders. Search shared drives for files named like password lists, portal logins, or "access for the consultant." Rotate anything you find.
- Call back on drawing links and invoices. Tell staff, clients, and subs that an unexpected "updated plan set," new upload link, or changed bank details gets verified at a number you already have, not the one in the message.
- Watch a company's own channels, not a leak site. If a peer, vendor, or consultant is named on a tracker, confirm anything unusual with a phone number you already have. Do not download files from a tracker or a "sample" link.
Brotherly Technology helps architecture, civil engineering, and design-build offices across Rome, Northwest Georgia, Atlanta, Chattanooga and the Southeast lock down project stores, set MFA on design portals, and confirm you can restore a current job file. If you'd like a short continuity review, give us a call.
Sources:
- Ransomware.live — Don Pickett & Associates / Sarcoma — Discovery 2026-10-23 11:48 UTC; Sarcoma leak-site listing as indexed on Oct. 23, 2026; claim-level only. Don Pickett & Associates has not confirmed or publicly commented on the claim.
- Don Pickett & Associates (donpickett.com/about-us) — Company context: family-owned Fresno corporation founded August 1988; in-house architectural design, drafting, and civil engineering. No incident acknowledgment cited here.
- Don Pickett & Associates (donpickett.com) — Public site for commercial, industrial, and design-build services; used for company context only.