Ferrer & Ojeda Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional-services firms that sit at the centre of commercial risk transfer, using data theft and public leak-site pressure as leverage. In that environment, listings of insurance brokers have become a recurring feature of the threat landscape, often involving large volumes of internal files rather than consumer databases alone.

On 27 July 2024 the ransomware group known as sarcoma listed Ferrer & Ojeda, a Spanish insurance intermediary, claiming to have exfiltrated internal files in a ransomware attack. Public detail on the incident remains limited: the number of people affected is unknown, and the precise method and timing of the intrusion have not been disclosed. The group’s leak-site entry describes a 1.27 TB archive of files. Because the listing is an unverified claim by the threat actor, the full scope and confirmation of the breach rest on what Ferrer & Ojeda or independent investigators may later establish.

Breaking down the breach

According to the available record, sarcoma publicly listed Ferrer & Ojeda on 27 July 2024. The group asserts that internal files were exfiltrated during a ransomware attack and that the resulting archive measures 1.27 TB and contains files. No further technical indicators—such as initial access vector, encryption status of systems, or negotiation timeline—have been made public. The number of individuals whose data may be involved is listed as unknown. The only concrete description of the material is the actor’s claim of “internal files.” Without corroborating statements from the organisation or forensic reporting, the listing itself remains the primary public source, and its accuracy is unconfirmed.

Inside sarcoma

Sarcoma is a ransomware operation that follows the now-common double-extortion model: data are stolen before systems are encrypted, and the threat of public release is used to pressure victims. Like other groups of this type, it maintains a leak site where it posts victim names, claimed data volumes, and sample files. Public reporting on sarcoma has associated it with opportunistic targeting of mid-sized enterprises across multiple sectors rather than a single industry focus. The group’s listings typically present large archive sizes and broad categories of files; those claims are marketing for the extortion effort and should be treated as such until independently verified. In the Ferrer & Ojeda case, sarcoma’s sole public assertion is the listing itself and the 1.27 TB figure; no additional statements specific to this victim have been recorded in the available facts.

About Ferrer & Ojeda

Ferrer & Ojeda operates as an insurance intermediary based in Spain. Public descriptions of the firm emphasise privileged access to national and international insurance markets and the ability to negotiate risk-coverage-cost ratios on behalf of clients. It reports working with more than seventy insurers and serving clients across manufacturing, construction, logistics, retail, chemicals and pharmaceuticals, engineering, energy, technology and media, education, consumer goods, tourism, real estate, health and welfare, professional services, the public sector and non-profit organisations. Firms of this kind routinely hold policy documentation, underwriting data, claims correspondence, client contact details and internal commercial records. A breach at such an intermediary can therefore affect both the organisation’s own operations and the confidentiality of information belonging to a wide range of corporate and institutional clients.

The information in question

The facts state only that “internal files” were claimed to have been exfiltrated and that the archive is described as 1.27 TB of files. No specific categories—such as personal data, financial records, medical information or credentials—are named. Organisations that broker insurance typically retain client identity and contact data, policy schedules, risk assessments, premium calculations, claims histories and internal emails. Whether any of those categories are present in the claimed archive is unconfirmed. Readers should therefore treat the contents as unknown beyond the broad label “internal files.”

What's at stake

For individuals or organisations whose information may appear in the files, the practical risks include unsolicited contact, social-engineering attempts that reference genuine policy or claims details, and potential secondary misuse of any personal or commercial data that may be present. For Ferrer & Ojeda the stakes include operational disruption, regulatory scrutiny under data-protection rules, possible contractual obligations to notify clients, and reputational impact among the insurers and corporate clients it serves. Because the scale of affected persons is unknown and the exact data types remain undisclosed, the concrete exposure for any single party cannot yet be quantified. The large claimed volume simply indicates that a substantial body of internal material may be in play if the actor’s assertion proves accurate.

Were you affected?

If you have a professional or personal relationship with Ferrer & Ojeda—whether as a client, employee, insurer partner or supplier—monitor communications for unusual requests that reference insurance matters and treat unsolicited messages with caution. Consider placing fraud alerts with relevant credit or identity services if you believe personal data may be involved. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Official confirmation of impact, if any, will come from Ferrer & Ojeda or competent authorities; until then, treat the sarcoma listing as an unverified claim and act on the basis of verified notices only.

AICompiled with AI assistance from public sources and published under our editorial standards.