ndceg.com targeted by Funksec in alleged data breach

• Ransomware group: Funksec
• Country: United States
• Sector: Professional Services
• Announcement date: January 7, 2025

The Funksec ransomware group has published a ransom announcement claiming to have successfully exfiltrated 20 GB of data from the organization ndceg.com. The threat actor announced the breach on January 7, 2025, marking a new incident for the group, which has been active since late 2024.

The details of the alleged attack

According to the announcement made on their leak site, the Funksec group claims to have gained unauthorized access to the systems of ndceg.com. The threat actor asserts that the intrusion resulted in the theft of a significant volume of information, specifically totaling 20 GB of data. This type of incident follows the common pattern of double extortion, where attackers not only encrypt a victim's systems but also steal sensitive information to use as leverage.

The group has issued a direct ultimatum regarding the stolen information. The announcement states that if the ransom is not paid, the exfiltrated data may be published publicly or sold to third parties. This tactic is a hallmark of modern ransomware operations, designed to pressure organizations into compliance by threatening their reputation and legal standing through the exposure of private data.

The types of data involved

The Funksec group has specified the nature of the information they claim to have obtained from the organization. The alleged breach involves several critical categories of digital assets that could provide deep insight into the victim's operations and infrastructure. The claimed data includes:

• Database files
• Website backups
• SSH private keys
• Email messages

The inclusion of SSH private keys and email content is particularly concerning for security professionals, as these assets often serve as gateways to further network access or sensitive internal communications.

Organization profile

The target of this alleged attack is ndceg.com, an organization based in the United States. The entity operates within the professional services sector.

Analysis and potential implications

The Funksec group is a relatively new threat actor that emerged in late 2024. Reports indicate that the group may utilize AI-supported tools to facilitate their operations. In this specific incident, the group has set a ransom demand of 500 USD. The relatively low price point for the data suggests that the group may be motivated by the desire for quick financial gain rather than a massive, high-stakes payout.

The alleged theft of SSH private keys and email messages significantly increases the risk of secondary attacks against the organization's infrastructure. SSH keys can allow attackers to maintain persistent access to servers, while email content can be used to craft highly convincing phishing campaigns or facilitate business email compromise. Furthermore, because the organization is based in the United States, this potential breach could lead to significant legal consequences under various state-level data protection laws and sectoral regulations.

For organizations operating in the professional services sector, such incidents highlight the necessity of robust defensive measures. To mitigate the risks associated with such breaches, organizations should consider implementing strict access controls, such as multi-factor authentication, and monitoring for unusual data exfiltration patterns. Additionally, because stolen email content and credentials can lead to identity theft and targeted phishing, it is often necessary for organizations to proactively warn their employees and customers about the potential for these secondary social engineering attacks.