FoccoERP Listed by trinity Ransomware Group

On October 2, 2024, Brazilian ERP provider FoccoERP appeared on the leak site of the trinity Ransomware Group. The listing, which became active on the group’s onion portal and was indexed via ransomware.live, states that the company suffered a ransomware attack resulting in the exfiltration of internal files. The threat actors claim to hold a 300 GB database belonging to a firm with roughly $20 million in annual revenue. Publication of the stolen data was scheduled for November 1, 2024. The exact number of individuals whose records were taken remains unknown.

Primary Disclosure Details

The trinity leak-site entry states that FoccoERP was compromised through a ransomware operation. It lists the victim’s name, revenue range, and the volume of data allegedly obtained but does not specify the precise file types or categories of personal information inside the 300 GB archive. The disclosure indicates the data was exfiltrated prior to encryption and is now held for extortion. No ransom amount or negotiation status is published on the listing itself. Public mirrors of the onion page, such as the one hosted on ransomware.live, preserve these claims exactly as posted by the operators.

Why This Matters for You and Your Family

When a company that supplies enterprise resource planning software is breached, the ripple effects reach far beyond its own walls. FoccoERP’s customers include mid-sized businesses whose payroll, customer invoices, supplier contracts, and employee tax documents may have been stored inside the compromised systems. If your employer, your child’s school, your medical provider, or any vendor you deal with uses FoccoERP, your personal or household data could be among the records now in criminal hands. The 300 GB volume suggests a large and varied dataset even though the exact number of affected people is not stated.

Doxxing and Identity-Chain Risks

Internal files from an ERP platform frequently contain spreadsheets that link names, national identification numbers, addresses, bank details, and email addresses. Once such data reaches a ransomware leak site, it is routinely repackaged and sold on underground forums. Threat actors then combine it with credential leaks from other breaches to build detailed identity chains. A single exposed work email can lead to your personal accounts, your children’s gaming profiles, and ultimately to physical addresses and family relationships. These chains accelerate doxxing, targeted phishing, and account takeovers that can affect every member of a household.

Trinity Ransomware Group Track Record

Public reporting attributes the trinity Ransomware Group with emerging in early 2024 as a double-extortion operation. The group is known for compromising organizations across Latin America and Europe, typically gaining initial access through phishing or exploited remote desktop services, exfiltrating data, deploying encryption, and then publishing samples on its leak site when victims refuse to pay. Notable prior victims listed on the same portal include manufacturing firms and regional government contractors. Their playbook relies on pressure through both data publication deadlines and threats to contact customers directly. The November 1, 2024 publication date set for FoccoERP follows this established pattern.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you used at FoccoERP or with any of its customers anywhere it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught and acted on in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and your children’s gaming accounts, which often become the next link in doxxing chains after credential leaks like this one.
• Let remediation specialists handle ongoing takedown requests across data brokers and leak forums on your behalf while you focus on securing your own devices and accounts.

The FoccoERP breach is a reminder that even companies you never directly signed up with can expose your family’s sensitive details. Staying ahead requires more than reactive checks; it demands continuous visibility and expert help when data surfaces in unexpected places. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today and treat this incident as the prompt to lock down every link in your digital life before the next leak appears.