FoccoERP Listed by trinity Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a company that builds the software many businesses rely on for daily operations appears on a ransomware group's leak site, the practical stakes fall first on ordinary people whose details may sit inside those systems. Employees, customers and partners of FoccoERP or of the firms that use its products have no way of knowing yet whether their names, contact details or financial records were among the material taken. Public reporting so far leaves the number of people affected unknown, yet the mere listing raises the possibility that internal files have left the organisation's control and could later surface for misuse.

On 2 October 2024 the ransomware group known as trinity listed FoccoERP on its leak site, claiming to have exfiltrated a 300 GB database and citing the company's revenue as $20 million, with a threatened publication date of 1 November 2024. That claim, and the limited details attached to it, form the entire public record of the incident at present.

Inside the incident

The only confirmed public fact is that FoccoERP was named on trinity's leak site on 2 October 2024. The group's listing describes the material as internal files obtained in a ransomware attack and quantifies the haul as a 300 GB database. It also states a company revenue figure of $20 million and sets a publication date of 1 November 2024. No independent confirmation of the volume, the exact contents or the success of any encryption has been released. The method of initial access, the duration of any dwell time inside the network, and whether a ransom demand was paid or ignored all remain undisclosed. The number of people whose data may be involved is likewise unknown. In short, the incident is known only through the group's own claim; nothing further has been verified by the organisation or by independent investigators.

Who is trinity?

Trinity is a ransomware operation that became active in the public eye during 2024. Like many contemporary groups it practises double extortion: after encrypting systems it also claims to steal data and threatens to publish the material on a dedicated leak site if payment is not made. The group typically posts short victim entries that include claimed data volumes, revenue estimates and countdown dates, then later releases sample files or full archives if the deadline passes without settlement. Its listings are therefore best treated as unverified claims rather than established fact. Trinity has previously named organisations across several sectors, but no specific statements it has made about FoccoERP beyond the leak-site entry itself are part of the public record. The group's operational pattern is well documented in open-source reporting; its assertions about any single victim are not.

Who is FoccoERP?

FoccoERP is a Brazilian developer of enterprise-resource-planning software used by mid-sized and larger companies to manage finance, inventory, production and customer records. Organisations of this type sit at the centre of their clients' day-to-day operations; the data they process routinely includes employee payroll details, supplier contracts, customer invoices and internal financial statements. A breach at an ERP provider is consequential because the same systems that keep businesses running also concentrate large volumes of commercially sensitive and personally identifiable information. Even if the attack remained confined to FoccoERP's own environment, the potential exposure of client-related files could ripple outward to every organisation that relies on the platform. Public detail about the precise scope of this incident is limited, yet the sector context alone explains why the listing attracted attention.

What data was at risk

The only data type named in the public record is "internal files" said to have been exfiltrated. The group further characterises the material as a 300 GB database. No inventory of specific fields—names, identity numbers, bank details, passwords or source code—has been released or independently verified. Organisations that develop and host ERP platforms typically hold employee records, customer and supplier databases, financial ledgers and configuration files that may contain credentials or system architecture details. Whether any of those categories were present in the claimed 300 GB set remains unconfirmed. Until samples appear or the company issues a fuller statement, the exact contents must be treated as unknown.

The real-world impact

For individuals whose information may have been inside the stolen files the concrete risks are familiar: possible use of personal details for phishing, account takeover or identity fraud, and the longer-term nuisance of having private data circulate among criminal markets. Because the number of people affected is unknown, it is impossible to gauge how widely those risks extend. For FoccoERP itself the listing creates operational and reputational pressure—clients may demand assurances, regulators may open inquiries, and the cost of forensic investigation and system hardening will fall on the organisation regardless of whether a ransom was paid. The threatened publication date of 1 November 2024 has now passed; if the group followed through, any released material could remain available indefinitely, prolonging the window of exposure. None of these outcomes is certain, yet each is a realistic consequence of a ransomware claim of this type.

If your data was in this claimed breach

If you have ever worked for, contracted with or been a customer of FoccoERP or of a company that uses its software, treat the possibility of exposure as real until proven otherwise. Begin by changing passwords on any accounts that might share credentials with work systems, enable multi-factor authentication wherever it is offered, and monitor bank and credit statements for unfamiliar activity. Consider placing a fraud alert with the relevant credit bureaus if you are in a jurisdiction that provides that service. Keep an eye on official statements from FoccoERP for any confirmation of what was taken and who is affected. Finally, you can run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets; such a scan will not prove or disprove involvement in this specific incident, but it can alert you to other exposures that warrant the same protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.