Funksec claims data breach against dealplexus.com

• Ransomware group: Funksec
• Country: India
• Sector: Healthcare
• Announcement date: December 11, 2024

Funksec claims a data breach at dealplexus.com

The threat actor known as Funksec has published data allegedly belonging to dealplexus.com on its leak site. According to the announcement made on December 11, 2024, the group claims to have successfully exfiltrated a database containing sensitive information from the platform.

The incident was announced on the same day the group claims the attack took place. This type of activity is common in modern cyberattacks, particularly in double extortion schemes. In such scenarios, threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to leak the stolen information on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of their proprietary or customer data.

Details of the alleged leak

The Funksec group has stated that the leaked data consists of approximately 30,000 lines of information. According to the group's claims, this data has been made available for download via their dedicated leak site. The information is said to include various types of sensitive data that could compromise both the organization and its users.

Based on the provided screenshots, the allegedly leaked data includes the following items:

• User IDs
• Email addresses
• Phone numbers
• Source code
• Secret keys

The exposure of such diverse data types presents a significant security challenge. While user identifiers and contact details pose direct risks to individuals, the inclusion of source code and secret keys introduces much deeper technical risks to the organization's infrastructure.

About dealplexus.com

DealPlexus is an India-based platform operating in the healthcare sector. The organization provides digital solutions for hospitals and healthcare organizations, focusing on enhancing collaboration and operational efficiency among healthcare providers. Due to its role in the healthcare sector and its connections to financial services, the sensitivity of the data handled by the platform is notably high.

Potential impact and security considerations

This alleged leak may pose secondary risks to dealplexus.com users, such as identity theft and targeted phishing attacks. When contact information like email addresses and phone numbers are leaked, attackers often use them to conduct highly personalized social engineering campaigns. Furthermore, the exposure of source code and secret keys could potentially facilitate further advanced attacks against the platform's infrastructure, as these elements provide a roadmap for understanding the system's architecture and vulnerabilities.

The emergence of the Funksec group in late 2024, combined with reports of their use of AI-powered tools, suggests that their attack capacity and speed may be significant. The use of artificial intelligence in cyberattacks allows threat actors to automate various stages of an attack, potentially increasing the volume and complexity of the data they can exfiltrate.

Because the entity is based in India, potential data breaches may be subject to local data protection regulations. Organizations operating in the healthcare and financial sectors are often considered critical infrastructure, meaning any breach can have cascading effects on public trust and operational stability. To defend against such threats, organizations typically implement multi-layered security strategies, including robust encryption, strict access controls, and continuous monitoring of their networks to detect unauthorized data movement.