Ministerio de Relaciones Exteriores Listed by onyx Ransomware Group

On September 27, 2022, the Ministry of Foreign Affairs of Costa Rica, known formally as Ministerio de Relaciones Exteriores, appeared on the leak site operated by the onyx ransomware group. The listing states that internal files were exfiltrated during a ransomware attack, although the exact volume and specific categories of data remain undisclosed by the group.

Details from the Leak-Site Listing

The onyx leak site entry states that the Costa Rican foreign ministry was listed as a victim and that the attackers claim to have stolen internal data. The disclosure does not quantify the number of records affected, name the precise systems compromised, or list the file types exfiltrated. It simply states that data was taken and gives the ministry a deadline to negotiate before further publication. Public copies of the listing, preserved through ransomware.live, show the initial posting occurred on September 27, 2022.

Why This Matters for You and Your Family

When a government ministry that handles passports, visas, consular records, and international communications is breached, the information stolen can easily include details about private citizens. Even if your name is not on a specific leaked document today, diplomatic and administrative databases frequently contain addresses, phone numbers, dates of birth, passport numbers, and family-member relationships. Once such data leaves official control it circulates among criminal networks and can be used for identity theft, targeted phishing, or extortion attempts against you or your relatives. The fact that the ministry has not released a detailed breach notification means you cannot assume your information was untouched.

Doxxing and Identity-Chain Risks

Ransomware operators rarely stop at the first dataset they obtain. A single leaked government email address or internal spreadsheet can link your work identity to personal accounts, social-media handles, and even children’s gaming profiles. These connections form an identity chain that lets attackers impersonate family members, reset passwords across services, or publish personal information to increase pressure on the victim organization. Credential leaks of this nature frequently cascade into account takeovers on platforms that use the same email or password combinations. DoxxScan by GalaxyWarden continuously monitors across 13.1B+ breach records and 100+ platforms with AI-powered identity-chain mapping and hands-on remediation by specialists, including household coverage that extends to children’s gaming accounts.

Onyx Ransomware Group Track Record

Public reporting attributes the onyx ransomware group with emerging in mid-2022 as a relatively new entrant that employs double-extortion tactics. The group typically gains initial access through phishing or exploited remote-desktop services, exfiltrates documents before deploying ransomware, and then posts samples on its leak site when victims refuse to pay. Notable prior targets have included manufacturing firms and smaller government entities, though the group’s overall volume of attacks remains lower than more established operations such as LockBit or Conti. Their playbook relies on public shaming through gradual data dumps rather than immediate mass publication, giving victims a short window to respond before additional material appears.

What to do

• Run a DoxxScan to map every link between your government-issued emails, personal accounts, phone numbers, and real-world identity, then use the cleanup of Warden to reduce exposure.
• Enable continuous DoxxScan monitoring so the next breach that touches your data or your family’s information is caught in hours rather than months.
• Rotate any password you have used at the Ministerio de Relaciones Exteriores or related Costa Rican government portals anywhere it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data-broker sites and leak forums where your information may already be appearing.

The breach of a national foreign ministry demonstrates how quickly official systems can expose ordinary citizens to long-term risk. Acting promptly on credential hygiene and identity mapping limits the damage before attackers stitch together the next link in the chain. Start your DoxxScan trial today and place continuous monitoring and specialist remediation between your family and the growing pool of stolen government data.