Funksec ransomware group lists thecitybank.com on its leak site

• Ransomware group: Funksec
• Country: United States
• Sector: Financial Services
• Announcement date: January 21, 2025

Funksec claims a data breach at thecitybank.com

The threat actor known as Funksec has listed the entity associated with the domain thecitybank.com on its leak site, alleging a data breach. This announcement, made on January 21, 2025, suggests that the group has successfully targeted the organization and may proceed to release stolen information.

According to the claims made by the group, they have gained access to the organization's internal systems. To support their claim of unauthorized access, the group has provided screenshots that appear to display the institution's operational management interface. These visual proofs are intended to demonstrate the level of access achieved by the attackers.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers do not merely encrypt a victim's data to demand a ransom for decryption; they also threaten to publish sensitive information on public platforms if the demands are not met. This tactic increases the pressure on the victim by threatening reputational damage and regulatory consequences.

Details of the alleged data exposure

The screenshots provided by the Funksec group show a management interface that appears to contain various operational details. The information visible in these images suggests that the attackers have accessed sensitive administrative areas of the organization's digital infrastructure.

Based on the available information, the following data types are reportedly involved in the breach:

• Financial service categories
• Branch transaction data
• Service codes

While the group has provided these screenshots, they have not provided specific details regarding the total volume of data stolen or the exact number of files compromised. Furthermore, no specific ransom demand has been disclosed in the public announcement.

About the target organization

The City Bank is a financial institution based in the United States, providing retail and commercial banking services. The organization operates with its headquarters located in New York.

Potential impact and security implications

This alleged breach may pose a risk of exposure for the organization's financial data and operational processes. As a US-based financial institution, a potential data breach could lead to regulatory scrutiny under the GLBA and relevant state laws. The exposure of customer information might facilitate identity theft and targeted phishing campaigns.

The Funksec group, which emerged in late 2024, is reported to utilize AI-assisted tools in its operations. The use of artificial intelligence in cyberattacks is an evolving trend that allows threat actors to automate certain stages of an attack or enhance the sophistication of their social engineering efforts.

For organizations operating in the financial sector, such incidents highlight the necessity of robust security postures. Common defensive steps for organizations include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security audits. Furthermore, it may be advisable for the organization to conduct a security audit and implement measures against potential secondary attacks, such as those involving identity theft or phishing, which often follow a primary data breach.