Footballticketnet.com listed on Funksec ransomware leak site

• Ransomware group: Funksec
• Country: Israel
• Sector: Retail & E-Commerce
• Announcement date: February 18, 2025

Funksec claims data breach at footballticketnet.com

The threat actor known as Funksec has listed footballticketnet.com on its dedicated leak site, claiming to have successfully exfiltrated sensitive user information from the platform. This announcement, made on February 18, 2025, follows an alleged attack occurring on the same date. The group claims to have stolen approximately 5 GB of data and has threatened to release the information if their demands are not met.

In a classic example of double extortion, the group is not only demanding a ransom for the decryption of systems but is also using the threat of a public data leak to pressure the organization. The group has reportedly set a ransom demand of 1,000,000 USD. Furthermore, the threat actors have claimed they are selling access to backdoors within the platform, which could potentially allow for further unauthorized access and exploitation of the network.

The alleged stolen data

The Funksec group has provided specific details regarding the volume and nature of the data they claim to have acquired during the breach. According to the group, the stolen dataset includes a massive amount of highly sensitive information that could pose significant risks to the individuals involved. The alleged data consists of the following items:

• 500,000 credit card numbers with CVV codes
• 3 million user email addresses
• Full names
• Phone numbers
• Chat logs
• Session tokens
• Ticket codes
• Coupons

The presence of such a high volume of financial and personal identifiers suggests a significant breach of user privacy and security. The inclusion of session tokens and ticket codes is particularly concerning, as these can be used to hijack active user sessions or fraudulent use of services.

About footballticketnet.com

Football Ticket Net is an online platform that sells tickets for football matches worldwide. The company provides ticket procurement and sales services for various football leagues and tournaments, serving a global customer base through its digital storefront.

Risk assessment and defensive considerations

This incident suggests that users' financial and personal data may be at significant risk. The exposure of credit card information could lead to direct financial loss and identity theft for the affected individuals. Given the platform's location in Israel, the incident may trigger legal scrutiny under local data protection laws and international standards such as GDPR.

The reported use of AI-supported tools by the Funksec group may increase the complexity of the attack and the risk of secondary exploitation. Such advanced techniques allow threat actors to automate various stages of the attack lifecycle, making detection and mitigation more difficult for traditional security measures.

For organizations operating in the retail and e-commerce sectors, such incidents highlight the critical importance of robust data protection strategies. To mitigate further damage, organizations facing similar threats may need to notify users immediately and consider suspending credit card processing to prevent unauthorized transactions. Implementing strong multi-factor authentication, regular security audits, and advanced monitoring to detect anomalous data exfiltration patterns are standard defensive steps to protect against modern ransomware and extortion tactics.