One Call (insurance) Listed by darkside Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 13, 2021, the ransomware group DarkSide listed One Call (insurance) on its leak site. The group claims to have stolen internal data during a ransomware attack. The number of people whose information may be involved is not publicly known, and no further details on the scale or method of the incident have been confirmed. Insurance customers and staff have a direct interest in understanding what happened, because organizations in this sector routinely collect and store records that can include personal identifiers, policy details, and financial information.

Breaking down the breach

The only confirmed public information is the listing itself. DarkSide posted One Call (insurance) on its data-leak site on the reported date and stated that internal files had been taken. No independent confirmation of the exfiltration has been released, and the company has not disclosed the volume of data, the types of files, or whether any data was later published.

Key elements such as the date of the intrusion, the number of records involved, and the precise attack vector remain undisclosed in available reporting.

The group behind it: darkside

DarkSide is a ransomware operator that has conducted multiple attacks since at least 2020. The group typically uses encryption to disrupt operations and maintains a leak site where it lists victims and threatens to release stolen files. Its approach combines technical intrusion with public pressure on targeted organizations. The listing of One Call (insurance) follows this established pattern, though the group’s claims about this specific case have not been verified by third parties.

Who is One Call (insurance)?

One Call operates in the insurance sector, handling policies, claims, and related administrative records. Companies of this type maintain databases that support underwriting, billing, and claims processing. A breach at such an organization can therefore touch information belonging to policyholders, claimants, and employees.

What was likely exposed

The only detail released is that internal files were allegedly exfiltrated. The exact contents of those files have not been disclosed. Organizations in the insurance sector commonly hold data such as names, addresses, dates of birth, policy numbers, payment information, and, in some cases, medical or claims documentation. Whether any of these categories were present in the exfiltrated material is unconfirmed.

Why it matters

Insurance records can contain information that remains useful for identity-related fraud or targeted scams long after an incident. For the organization, the event adds operational costs, potential regulatory scrutiny, and the need to review security controls around data storage and access. Because the number of affected individuals is unknown, the full scope of downstream consequences cannot yet be measured.

If your data was in this claimed breach

Individuals who held policies or made claims with One Call can take the following steps:

• Monitor account statements and credit reports for unusual activity.
• Contact the company directly to ask what information it holds on them and whether it has issued any notifications.
• Consider placing fraud alerts with credit bureaus if financial details were likely stored.
• Run a free exposure scan of their email address against known breach data to check for appearances in other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.