Skip to main content
Darkfield

Ransomware victim disclosure

← All victims

Popular Life Insurance

Claimed by Sarcoma · listed 2 years ago

36 GB
Data size
20m
Age
since listed · data leaked

Status timeline

  1. ListedNov 14, 2024
  2. Data leakeddate unknown

At a glance

Group
Sarcoma
Status
Data leaked
Country
Bangladesh
Sector
Financial
Listed on leak site
Nov 14, 2024
Data size
36 GB

About the victim

AI dossier — public-source company profile

Popular Life Insurance PLC is a leading Bangladeshi life insurance company established in 2000 and listed on both Dhaka and Chittagong stock exchanges. The company offers a wide range of life insurance products including micro-insurance for low-income populations, individual life policies, and ordinary life plans. As of 2021, the company manages total assets of approximately 23.6 billion taka with over 3.85 million policyholders.

Industry
Life Insurance
Address
Bangladesh
Founded
2000

Attack summary

Severity: critical — Confirmed exfiltration of 36 GB of data from a licensed insurance company holding sensitive personal information on 3.85+ million policyholders, including policy records and likely PII at scale. Regulated financial sector entity with operational impact.

Sarcoma claims to have exfiltrated 36 GB of data from Popular Life Insurance, including files and SQL databases. The group has published the data without specifying ransom demands.

critical

Data the group says was taken

AI dossier — extracted from the leak post
  • SQL databases
  • Customer policy records
  • Financial data
  • Corporate files

What the group claims

Popular Life Insurance Popular Life Insurance Co. Ltd. established by a group of local enthusiastic entrepreneur started its operation in September 26, 2000. Since inception, Popular Life set before itself a high standard of all round performance coextensive with professional soundness and proficiency. It soon made a mark in the life insurance arena by not only being the leader among the private sector indigenous companies, but by undertaking and successfully implementing innovative and welfare oriented life insurance schemes. But more importantly, in fulfilment of the avowed commitment towards social development, Popular Life introduced micro-life insurance-cum-savings products specially suited to the needs and pockets of poor people of the country who constitute more than 80% of the people of Bangladesh. Micro Individual Life Al-Amin Bima Ekok Bima Janapriya Bima Islami Bima Takaful Islami DPS Al-Barakah Islami Bima (Ekok) Al-Barakah Islami DPS Janapriya Ekok Bima Popular DPS IDPS Ekok Bima Al-Amin Ekok Bima Ordinary Life Popular Life offers a wide variety of ordinary life product/plans ranging from the most common endowment type to more modern and sophisticated plans like payments scheme policies (biennial/three/four/five payments), pension plan, Hajj Bima, education stipend plans,chield protection.Geo: Bangladesh - Leak size: 36 GB Archive - Contains: Files,SQL

Sources

Source

Indexed 2 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About Sarcoma

Sarcoma is a relatively new ransomware group that emerged in October 2024, operating with apparent financial motivations and demonstrating a broad international targeting approach with at least 140 documented victims across multiple countries and industry sectors. The group's origin and affiliations remain unclear due to its recent emergence, with no publicly documented connections to established ransomware families or confirmation of whether they operate as an independent entity or through a Ransomware-as-a-Service model. Limited public information is available regarding Sarcoma's specific attack methodologies, initial access vectors, or technical capabilities, though their targeting patterns suggest opportunistic rather than highly selective victim selection across diverse industries including manufacturing, business services, agriculture and food production, and technology sectors. The group has shown a particular focus on victims in the United States while also maintaining operations against targets in Italy, Canada, Germany, and Australia, though no specific high-profile attacks or record ransom demands have been publicly documented by major security firms or law enforcement agencies. Given the group's recent emergence in late 2024, Sarcoma appears to remain active with no reported law enforcement disruptions or confirmed rebranding activities at this time. The group has been linked to 150 public disclosures across our corpus. First observed on a leak site on October 9, 2024; most recent post May 12, 2026. The operation is currently active.

Also tracked as: Sarcoma Ransomware Group.

Timeline of this disclosure

  • November 14, 2024Popular Life Insurance listed by Sarcomaon the group's public leak site
Data size
36 GB

Other recent disclosures by Sarcoma

Sarcoma has been linked to 150 public victims on Darkfield. A sample of the most recent:

See the full Sarcoma dossier →

Sector and geography

This disclosure adds to ransomware activity in the Financial sector, which has 426 disclosures indexed across all operators we track. Geographically, Popular Life Insurance is reported in Bangladesh, a country with 3 ransomware disclosures in our corpus.

If your organisation is affected

A listing by Sarcoma means Popular Life Insurance appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

  • Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
  • Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
  • Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
  • Monitor for the data appearing on Sarcoma's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.