Funksec claims data leak of cara.com.my

• Ransomware group: Funksec
• Country: Malaysia
• Sector: Retail & E-Commerce
• Announcement date: February 5, 2025

Funksec claims a massive data breach at cara.com.my

The threat actor known as Funksec has officially listed the Malaysian organization cara.com.my on its dedicated leak site. According to the announcement posted on February 5, 2025, the group claims to have successfully exfiltrated a significant volume of data from the company's internal systems. The group alleges that the total amount of compromised information reaches approximately 100 GB.

This type of activity is characteristic of modern ransomware operations, often involving double extortion tactics. In these scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release stolen information on public leak sites, threat actors attempt to pressure organizations into meeting ransom demands to prevent the exposure of proprietary or sensitive information.

Details of the alleged theft

The announcement made by Funksec specifies that the breach involves various technical assets and sensitive files. The group claims that the stolen content includes critical infrastructure components that could provide deep insight into the organization's internal environment. Specifically, the group alleges that the following types of data were compromised:

• Network images
• IPS logs
• Network backups
• Docker packages

The inclusion of such technical data is particularly concerning for any digital infrastructure. When network backups and configuration files are leaked, it provides a roadmap for future malicious activity. Furthermore, the presence of Docker packages and IPS logs suggests that the attackers have gained access to the very tools and logs used to manage and monitor the network, potentially allowing them to understand how to bypass security measures in subsequent attempts.

The organization profile

Cara is a Malaysia-based retail and e-commerce company. The organization engages in the sale of various consumer products, serving customers through digital and retail channels. Given its role in the e-commerce sector, the company manages a variety of digital assets and consumer-facing services.

Risk assessment and industry implications

The claim made by Funksec poses significant risks to the operational continuity and the intellectual property rights of cara.com.my. The alleged compromise of network backups and Docker packages is especially dangerous, as these assets could facilitate further advanced attacks against the organization's infrastructure. Such technical leaks can be used to identify vulnerabilities or to conduct more sophisticated, targeted intrusions in the future.

Because the organization operates within Malaysia, it may face legal obligations under the Personal Data Protection Act (PDPA) regarding the handling and protection of data. Organizations in the retail and e-commerce sectors must be particularly vigilant, as they are frequent targets due to the high value of the consumer data they manage. Common defensive steps for organizations in this sector include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular network segmentation to limit the lateral movement of attackers.

While public information regarding the Funksec group remains limited, there are claims that the group utilizes AI-powered tools. This suggests that their attacks may be conducted through automated methods, which can increase the speed and scale of an intrusion. Additionally, secondary risks must be considered, such as the potential for the leaked technical data to be utilized in supply chain attacks, where attackers target a company's partners or service providers using the information gained from the initial breach.