Funksec ransomware group lists extremeperformance.com on its leak site

• Ransomware group: Funksec
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: March 12, 2025

Funksec claims to have exfiltrated data from extremeperformance.com

The threat actor known as Funksec has officially listed extremeperformance.com on its leak site. According to the announcement made on March 12, 2025, the group claims to have successfully compromised the organization and exfiltrated a significant amount of data. This incident follows a pattern often seen in modern cyberattacks where threat actors use public leak sites to pressure organizations by threatening to release sensitive information.

The Funksec group, which is recognized as a relatively new actor having emerged in late 2024, has provided screenshots and data samples that they claim were taken directly from the organization's databases. This type of evidence is frequently used by ransomware groups to demonstrate the validity of their claims and to increase the pressure on the victimized entity.

The scope of the alleged data exfiltration

The announcement made by Funksec specifies that the volume of stolen information is approximately 6 GB of database content. The group claims that this data includes various sensitive categories that could impact both the company's operations and its customer base. The specific types of data allegedly compromised include:

• Customer email addresses
• Customer phone numbers
• Order data
• API keys

The inclusion of API keys in the alleged leak is particularly concerning, as such credentials can provide unauthorized access to digital infrastructure and facilitate further technical exploitation.

About extremeperformance.com

Extreme Performance is a retail company based in the United States that operates within the retail and e-commerce sector. The company specializes in providing high-performance automotive parts and accessories. Their business focus is centered on supplying components and upgrades specifically designed for modified and performance-oriented vehicles.

Analysis and potential implications

This alleged data breach carries several significant risks. For the organization's customers, the exposure of personal details such as email addresses, phone numbers, and order history significantly increases the risk of identity theft and targeted phishing attacks. When attackers possess specific details about a customer's purchase history, they can craft highly convincing social engineering campaigns.

Furthermore, the alleged exposure of API keys may facilitate secondary attacks against the organization's digital infrastructure, potentially allowing attackers to bypass certain security layers. The use of AI-powered tools by the Funksec group is a notable factor in this incident; such technology can enable threat actors to process and exploit stolen data with increased speed and efficiency.

Because the organization is based in the United States, this incident could trigger legal scrutiny under various state-level data protection laws and potential consumer rights regulations. Organizations facing similar threats typically need to review their security protocols and consider notifying affected users to mitigate the impact of the breach.

In the broader context of cybersecurity, this incident highlights the evolving nature of ransomware groups. As new actors emerge using advanced tools, the complexity of defending against them increases. Organizations in the retail and e-commerce sectors often prioritize the protection of customer databases and API security to prevent the types of secondary exploitation described in this claim.