The Plastic Bag Company

Summary

The Plastic Bag Company, a Sydney-based manufacturer with 30 years of experience in converting, printing, and extruding, was listed on the Sarcoma ransomware gang's dark web leak site in October 2024. The attackers claimed to have stolen 3.6 gigabytes of data and threatened publication within 26 days.

Attack Vector

The newly emerged Sarcoma ransomware group breached The Plastic Bag Company's systems and exfiltrated 3.6GB of data. The group appeared overnight in October 2024 with 30 victims listed, claiming over 5 terabytes of total stolen data. Sarcoma does not appear focused on specific industries or countries but showed slight preference for USA, Canada, Australia, and Spain.

Consumer Impact

The stolen data includes tax returns with partial tax file numbers, wage details, insurance documents, and passport scans. Some passports remain valid and belong to Australian and New Zealand nationals, creating ongoing identity theft risk. The exposure of tax file numbers combined with passport information represents severe privacy compromise for affected employees.

Response

No public response from The Plastic Bag Company has been documented. The company, located in Smithfield, New South Wales, was one of three Australian organizations targeted by Sarcoma during the group's initial October 2024 campaign alongside Perfection Fresh and Road Distribution Services.