Funksec claims data breach involving herbalcanadaonline.com

• Ransomware group: Funksec
• Country: Canada
• Sector: Agriculture and Food Production
• Announcement date: February 7, 2025

The ransomware group known as Funksec has officially listed herbalcanadaonline.com on its leak site. In a recent announcement, the threat actor group claimed to have successfully exfiltrated data from the systems of the organization, signaling a potential data breach involving sensitive information.

The details of the claim

According to the announcement posted on February 7, 2025, the Funksec group has targeted herbalcanadaonline.com. The group claims that they have gained unauthorized access to the organization's systems and have successfully exfiltrated data. The threat actor's post suggests that the information allegedly belonging to the organization's users and its internal operational processes will be published on their platform.

Ransomware groups often employ a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak the stolen data on public leak sites, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. This method increases the pressure on organizations, as the reputational and legal consequences of a public leak can be severe.

The claim made by Funksec was accompanied by evidence intended to validate their intrusion. The announcement included screenshots that allegedly contain images taken directly from the organization's administrative panel, which the group uses to demonstrate their level of access to the internal environment.

Data allegedly involved in the leak

The threat actor has provided specific details regarding the volume and type of information they claim to have stolen. The group asserts that the exfiltrated data includes a significant amount of user-related information and operational identifiers. Specifically, the claim includes the following types of data:

• User phone numbers
• User full names
• Report IDs

The group claims to have obtained 2000 user phone numbers and full names, along with 50,000 report IDs and other unspecified information. While the specific size of the total data exfiltration was not provided by the group, the volume of individual records mentioned suggests a significant impact on the organization's user database.

Organization profile

The target of this alleged attack is herbalcanadaonline.com, an organization operating within the Agriculture and Food Production sector. Based in Canada, the company's operations are subject to the regulatory environment of its jurisdiction.

Implications and defensive considerations

The alleged leak poses a significant risk to the privacy of the organization's customer data. Because the organization operates in Canada, it may face specific legal obligations regarding data breach notifications under the Personal Information Protection and Electronic Documents Act (PIPEDA). Such regulations often require organizations to notify individuals and relevant authorities when a breach involving personal information is detected.

The specific nature of the leaked data—namely phone numbers and full names—could facilitate secondary attacks. Such information is highly valuable to cybercriminals for conducting phishing campaigns or fraudulent activities, as it allows them to craft more convincing social engineering attempts against the affected customers. Furthermore, reports regarding Funksec's use of AI-powered tools suggest that their attacks may be more targeted and effective, highlighting a growing trend where threat actors utilize artificial intelligence to enhance their capabilities.

To mitigate these secondary risks, organizations facing such threats may need to notify affected users and conduct a comprehensive review of their system security. General defensive measures for organizations in the food production and agriculture sectors include implementing multi-factor authentication (MFA), maintaining strict access controls, and conducting regular security audits to identify vulnerabilities before they can be exploited by sophisticated actors.