Trinity of Chaos: New Alliance of Hackers Extorts 39 Firms, Leaking Data Stolen from Cisco, Google, and Global Airlines

According to Resecurity’s HUNTER team, a cybercriminal alliance calling itself “Trinity of Chaos” extorts 39 firms and leaks data stolen from Cisco, Google and various global airlines via a Data Leak Site on the TOR network. The group, which Resecurity says has evolved from a data theft operation into a ransomware syndicate, claims victims include Google, Cisco, Toyota, FedEx, Disney, Marriott and Air France–KLM, among others, and threatens to report breaches to regulators under data protection laws such as GDPR.

Their published materials include samples of stolen records and previously unreleased data from past intrusions, with Salesforce and OAuth token abuse cited as part of how access was gained. Among the breaches highlighted, Aeroméxico’s incident is dated 4 July 2025 and is said to have exposed 39 million records containing PII and loyalty data, while the group claims to possess a colossal archive of 1.5 billion records across 760 companies. The data could fuel AI-driven cybercrime, with potential for targeted phishing and social engineering, according to Resecurity.