Stayzapp.in listed on funksec leak site

• Ransomware group: funksec
• Country: India
• Sector: Hospitality
• Announcement date: February 28, 2025

Funksec claims a breach of stayzapp.in

The ransomware group known as funksec has listed the Indian hospitality company stayzapp.in on its dedicated leak site. According to the announcement made on February 28, 2025, the threat actors claim to have successfully breached the organization's systems and exfiltrated various datasets during an attack that reportedly occurred on the same day.

The group's claims suggest a sophisticated intrusion method. Specifically, the announcement indicates that a zero-day vulnerability within Plesk may have been utilized to gain unauthorized access to the organization's digital infrastructure. This type of attack, targeting unpatched or unknown vulnerabilities in widely used server management software, highlights the ongoing risks faced by digital service providers.

Alleged data exfiltration details

The threat actors claim to have stolen a total of 5 GB of data from the victim's environment. While the specific file count and the amount of any ransom demand remain unknown, the group has identified several categories of sensitive information that were allegedly compromised during the incident.

The data types identified in the leak site announcement include:

• Backup files
• Plugin credentials
• Database dumps
• SSH access keys

In the context of modern cyberattacks, such as double extortion, threat actors often steal sensitive information before encrypting systems. This allows them to pressure victims by threatening to release the stolen data publicly if a ransom is not paid. The presence of highly sensitive assets like SSH access keys and database dumps significantly increases the severity of the incident.

About stayzapp.in

Stayzapp.in is an India-based hospitality and hotel booking platform. It operates as a digital service provider, offering a variety of hotel and accommodation options to its users through its digital services.

Security implications and organizational risks

This incident poses a significant risk to the organization's digital assets and the security of its customer data. The potential exposure of SSH access keys and database dumps is particularly concerning, as these assets can be used to facilitate secondary attacks or provide unauthorized access to the organization's internal systems.

Furthermore, the reported use of AI-powered tools by the funksec group suggests that these attacks may be increasingly sophisticated, making detection and prevention more challenging for traditional security measures. Given the nature of the breach, the organization may also face legal obligations under Indian data protection regulations regarding the handling and protection of user information.

For organizations operating in the digital services and hospitality sectors, such incidents underscore the necessity of robust security postures. Common defensive steps often include the immediate invalidation of leaked credentials and access keys to prevent further unauthorized entry. Additionally, conducting a comprehensive security audit is a critical step in identifying the scope of a breach and hardening the infrastructure against future exploitation of vulnerabilities.