escriba.com.br Listed by threeam Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who rely on Brazil’s extrajudicial notary system—property buyers, business owners, heirs, and anyone whose documents pass through a cartório—may now face uncertainty about whether internal operational data tied to those services has been exposed. On 16 May 2024 the ransomware group threeam listed escriba.com.br on its leak site, claiming it had exfiltrated internal files. The number of individuals affected remains unknown, and public detail about exactly what left the network is limited, yet the listing alone raises practical questions for anyone whose records or credentials might sit inside those systems.

Because escriba.com.br supplies software used by notaries across the country, a compromise of its internal files could touch more than one company’s servers; it could affect the integrity of the tools that process deeds, protests and other high-value documents. What follows is a careful account of what is known, what is claimed, and what remains undisclosed.

Breaking down the breach

Public reporting on 16 May 2024 stated that escriba.com.br had been listed by the threeam ransomware group. The group claimed that internal files had been exfiltrated during a ransomware attack. No confirmed figure for the volume of data, no list of specific file names, and no technical description of the initial access method have been released in the available record. The number of people whose information may be involved is likewise unknown. In short, the incident is documented only through the group’s leak-site claim and the accompanying statement that internal files were taken; further operational details remain undisclosed.

Who is threeam?

threeam is a ransomware operation that became publicly visible in 2023. Like many contemporary groups, it typically follows a double-extortion model: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. Victims are commonly named on a dedicated leak site, sometimes accompanied by sample files or countdown timers. The group has previously targeted organisations in multiple sectors and geographies; its listings are claims that must be treated as unverified until independent confirmation appears. In the present case, threeam asserts that it obtained internal files from escriba.com.br; that assertion has not been independently corroborated in the public facts available here.

Who is escriba.com.br?

escriba.com.br describes itself as the largest Brazilian firm specialising in systems and solutions for cartórios extrajudiciais—the network of private notaries that handle property registration, notes, protests and related extrajudicial acts. The company develops software for the management of these offices, including tools used by tabelionatos de notas, tabelionatos de protestos and other ofícios. Because cartórios process documents that establish ownership, debt and civil status, the software that underpins their daily work sits at a sensitive intersection of private data and public legal effect. A breach affecting the vendor that supplies those systems therefore carries consequences beyond a single corporate network.

The information in question

The only data category named in the public record is “internal files” said to have been exfiltrated in a ransomware attack. No further breakdown—customer lists, source code, credentials, financial records or personal data of notary clients—has been disclosed. Organisations of this type routinely hold source code, configuration files, internal documentation, employee information and, in some cases, operational data supplied by the cartórios they serve. Whether any of those categories were among the files claimed by threeam remains unconfirmed. Readers should therefore treat the precise contents as unknown rather than assume any specific dataset has been published.

Why it matters

For individuals, the practical risk is that personal or transactional details processed through notary software could later appear in criminal markets or be used for fraud, identity misuse or targeted social engineering. Even if only internal corporate files were taken, those files might contain credentials, network maps or process documentation that could facilitate further attacks on cartórios or their clients. For the organisation itself, the listing creates reputational pressure, potential regulatory scrutiny under Brazilian data-protection rules, and the operational cost of verifying what was actually removed. Because the scale of exposure is still unknown, both the company and the people who depend on its products must operate under incomplete information—an uncomfortable but common reality after ransomware claims of this kind.

What to do if you're exposed

If you have done business with a cartório that uses escriba.com.br systems, or if you are an employee or partner of the company, treat the claim as a prompt for basic hygiene rather than confirmed catastrophe. Concrete first steps include:

• Monitor bank and credit accounts for unexpected activity and enable transaction alerts where available.
• Change passwords on any accounts that may have been used in connection with notary services, and enable multi-factor authentication.
• Be alert to phishing or phone calls that reference recent property, inheritance or protest matters; verify such contacts through official channels.
• Request a free exposure scan of your email address against known breach corpora to see whether your address has already appeared in other incidents.
• If you receive formal notice from escriba.com.br or a cartório, follow the specific guidance it provides and retain copies of any correspondence.

Public detail remains limited; these measures reduce ordinary risk while further facts, if any, emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.