Dona Formosa
bd_f8a3f67b0fa8ff79 · schema v1 · pii pii-v1
Full breach record for Dona Formosa →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Sarcoma on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Dona Formosa Since our founding in 1999, we have dedicated our expertise to the manufacturing of dairy products and the distribution of partner brands. Our journey, which began more than two decades ago, continues to be marked by an unwavering commitment to excellence. Our dedication to quality is recognized by renowned chefs who choose our products for their dishes in restaurants, buffets and industrial kitchens. In addition, we are trusted by hundreds of points of sale, including large supermarket chains. In this way, we offer top-quality products to a wide range of audiences, consolidating our position as a reference in the market. Located in Águas Formosas, our industry is the beating heart where each Dona Formosa product is carefully crafted. In addition, our Distribution Center (DC) in Belo Horizonte ensures efficient and agile delivery, connecting our exceptional products to homes and commercial establishments throughout the state of Minas Gerais. At Dona Formosa, our trajectory is more than a success story, it is a constant commitment to quality, tradition and customer satisfaction. We are proud to be a brand that continues to grow and evolve, always bringing the best in dairy products to you and your family. Welcome to the tasty world of Dona FormosaGeo: Brazil - Leak size: 4 GB Archive - Contains: Files
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Jan 16, 2025
Claim posted
—
No filing yet · watching
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
No regulatory filing corroborates this yet — it is the attacker's own assertion. Watch this entity to be notified the moment a filing corroborates or contradicts it.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
sarcoma
According to ransomware.live, Sarcoma is a ransomware group that debuted in October 2024, immediately ranking among the top three most active groups globally and surpassing 116 documented victims by mid-2025, targeting mid-market companies across manufacturing, retail, healthcare, legal, and business services with roughly 50% of victims in the United States.