Mandarin.com.br targeted by Funksec in massive data breach claim

• Ransomware group: Funksec
• Country: Brazil
• Sector: Technology
• Announcement date: February 28, 2025

The threat actor known as Funksec has officially listed the Brazilian technology agency mandarin.com.br on its leak site. According to the announcement made on February 28, 2025, the group claims to have successfully exfiltrated a massive volume of confidential information from the organization's systems.

The details of the alleged attack

The Funksec group announced the breach on February 28, 2025, alleging that they have obtained a total of 14 TB of confidential data. This claim suggests that the threat actors managed to penetrate the company's infrastructure and access sensitive information regarding business processes and client-related data. While the group has posted this information on their leak site, the specific details regarding the method of entry or the ransom demand have not been provided in the announcement.

In modern cyberattack landscapes, groups like Funksec often employ double extortion tactics. This method involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information to use as leverage. By threatening to leak the stolen data on public forums or specialized leak sites, attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or customer information.

The scope of the claimed data exfiltration

The information allegedly stolen by the Funksec group is vast, spanning multiple categories of sensitive corporate and personal data. The group claims that the exfiltrated files include a wide variety of digital assets that could be used for further malicious activities. The specific types of data mentioned in the claim include:

• SAE records
• Sent emails
• Private documents
• FTP transfers
• Archives
• Business data
• API information
• Client data

The inclusion of API information and client-specific data is particularly significant, as these elements often serve as gateways for subsequent malicious actions or can be used to impersonate legitimate services.

About mandarin.com.br

Mandarin is a digital marketing and technology agency based in Brazil. The company provides specialized services to its clients in several key areas, including data-driven strategies, digital transformation, and performance marketing. Given its role in managing digital strategies and client data, the organization operates within the technology sector.

Implications and potential risks

The claim made by Funksec could have significant negative impacts on the operational continuity and client trust of mandarin.com.br. The presence of API information and client data among the allegedly leaked files increases the risk of secondary attacks and targeted phishing attempts against both the company and its partners. Furthermore, because the company operates in Brazil, it may face legal obligations regarding data breach notifications under the LGPD (General Data Protection Law).

The complexity of such attacks may be high, especially if the group utilizes AI-powered tools to facilitate the exfiltration or analysis of data. For organizations in the technology and digital marketing sectors, these types of incidents highlight the importance of robust security postures. Risks stemming from such leaks can extend beyond the immediate victim to include the company's entire supply chain partners.

To mitigate these risks, organizations typically focus on several defensive layers. This includes implementing strict access controls to limit the exposure of sensitive API keys, maintaining comprehensive logging to detect unauthorized FTP transfers, and employing advanced monitoring to identify unusual data exfiltration patterns. Additionally, robust encryption for data at rest and in transit remains a fundamental requirement for protecting client information and maintaining business integrity in the face of sophisticated threat actors.