Sarcoma ransomware group leaks data from Sydney's The Plastic Bag Company

The Plastic Bag Company, a Sydney-based packaging manufacturer, was named on the leak site of the Sarcoma ransomware group in October 2024. Sarcoma had surfaced days earlier with about 30 victims listed at once, claiming more than five terabytes of stolen data in aggregate.

The group said it had taken 3.6 gigabytes from the manufacturer and published a sample as proof. Cyber Daily reported that the released files included tax returns showing partial tax file numbers, wage and payroll details, insurance documents and passport scans belonging to Australian and New Zealand nationals. Australian Cyber Security Magazine described the same material as including partial tax file numbers and passport scans.

Sarcoma did not name a ransom figure in its post. It instead set a countdown, threatening to publish the full data set within 26 days if its demands were not met. The company's website was offline and showing a maintenance notice at the time of reporting.

The Plastic Bag Company had not issued a public statement about the incident as of the reporting date, and neither the number of affected individuals nor the method of intrusion had been established. It was one of four Australian organizations Sarcoma listed in quick succession, alongside Perfection Fresh, Road Distribution Services and Meshworks.