Funksec ransomware group lists deportesapalategui.com on its leak site

• Ransomware group: Funksec
• Country: Spain
• Sector: Professional Services
• Announcement date: December 29, 2024

Funksec claims data breach at deportesapalategui.com

The threat actor known as Funksec has officially listed the Spanish organization deportesapalategui.com on its dedicated leak site. According to the announcement made on December 29, 2024, the group claims to have successfully executed a cyberattack against the retailer, resulting in the exfiltration of sensitive information. This incident follows a common pattern observed in modern cybercrime, where threat actors utilize double extortion tactics to pressure victims into paying ransoms.

In a double extortion scheme, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data before the encryption phase. The threat of leaking this stolen information on public forums or selling it to third-party malicious actors serves as a powerful lever to compel the victim to meet financial demands. This method significantly increases the pressure on organizations, as the risk shifts from mere operational downtime to long-term reputational damage and legal liabilities.

Details of the alleged attack and ransom demand

The Funksec group asserts that they have gained unauthorized access to the organization's internal database and its website content. The timeline provided by the attackers suggests the claim was made on the same day as the alleged attack, December 29, 2024. The group has issued a specific ransom demand to the organization, requesting either 0.1 BTC or a payment of 5,000 USD to prevent the release of the stolen data.

The attackers have explicitly stated that failure to meet these financial demands will result in the data being made public or being sold to third parties. Such threats of secondary extortion—where data is sold to other criminals even if a ransom is paid—represent a growing complexity in the ransomware landscape. This specific threat actor, Funksec, is noted for having limited public information available regarding their specific methods and infrastructure, making them a difficult entity for defenders to profile.

Scope of the alleged data exfiltration

While the exact volume of the stolen data has not been specified in terms of file size, the group has provided details regarding the types of information they claim to have acquired. The alleged breach involves a significant amount of customer-related information and internal business data. The items cited in the leak site announcement include:

• Website database
• Website content
• 7,000 customer email addresses
• Invoice information

The inclusion of invoice information and customer email addresses suggests that the attackers may have targeted systems containing transactional history and personal identifiers. Such data is highly valuable in the underground economy for various illicit purposes.

Organization profile

Deportes Apalategui is a sports equipment retailer based in Spain. The company's business model involves the sale of various types of sports equipment and apparel to its customer base.

Potential risks and organizational implications

The claims made by Funksec pose several significant risks to the organization and its customers. For the customers of Deportes Apalategui, the exposure of email addresses and invoice information significantly increases the risk of identity theft and targeted phishing attacks. Phishing campaigns often leverage specific details found in invoices to create highly convincing fraudulent communications designed to steal further credentials or financial information.

Furthermore, because the organization operates within Spain, this incident may trigger mandatory data breach notification obligations under the General Data Protection Regulation (GDPR). Regulatory bodies often require organizations to report such incidents within strict timeframes if the breach poses a risk to the rights and freedoms of individuals. Additionally, there are reports suggesting that the Funksec group may utilize AI-supported tools to conduct their operations. The integration of artificial intelligence in cyberattacks can increase the complexity and efficiency of the assault, potentially jeopardizing an organization's operational continuity.

To defend against such threats, organizations in the professional services and retail sectors typically implement multi-layered security strategies. This includes robust backup solutions, strict access controls, and continuous monitoring of network traffic to detect unauthorized data movement. Maintaining an incident response plan and ensuring compliance with regional data protection laws are also critical components of a modern cybersecurity posture.