tsmx.net.br listed on Funksec leak site following alleged data breach

• Ransomware group: Funksec
• Country: Brazil
• Sector: Technology
• Announcement date: January 28, 2025

Funksec claims data exfiltration from tsmx.net.br

The threat actor group known as Funksec has listed the Brazilian organization tsmx.net.br on their leak site. According to the announcement made on January 28, 2025, the group claims to have successfully exfiltrated data from the organization. This type of activity is characteristic of modern ransomware operations, where threat actors move beyond simple encryption to a method known as double extortion. In double extortion, attackers not only lock the victim's systems but also steal sensitive information, threatening to release it publicly unless a ransom is paid, thereby increasing the pressure on the target organization.

The claim suggests that the Funksec group managed to gain unauthorized access to the organization's system management infrastructure. By infiltrating these core management layers, the attackers assert they were able to obtain various types of data. The announcement was posted on the same day the group claims the attack occurred, which was January 28, 2025.

Details of the alleged data theft

The information provided by the threat actor indicates a significant breach of organizational assets. While the specific ransom demand has not been disclosed, the group has provided details regarding the nature and volume of the data they claim to have stolen. According to the announcement and accompanying screenshots, the total size of the alleged exfiltrated data is approximately 600 MB.

The content of the stolen data, as claimed by the attackers, includes several types of files that could be highly sensitive for a service provider. The specific items mentioned in the listing include:

• Website backups
• Excel (.xls) files
• PDF documents

The presence of website backups and various document formats suggests that the attackers may have targeted administrative and operational files, which often contain critical business information or client-related details.

About tsmx.net.br

TSMX is a technology and IT services company based in Brazil. The company provides IT solutions and technological infrastructure services to corporate clients. Given its role in providing technological infrastructure, the organization plays a vital part in the digital operations of its clients, making the security of its internal systems and management infrastructure a high priority for its stakeholders.

Potential risks and organizational implications

This incident may pose a risk of exposure for operational data and user information within tsmx.net.br. The claims regarding Funksec's use of AI-supported tools suggest that their attack operations may involve a high level of automation, potentially allowing them to conduct large-scale or highly efficient campaigns. For an organization operating in Brazil, the entity may face data breach notification obligations under the LGPD (General Data Protection Law), which governs how personal data must be protected and reported in the event of a compromise.

The potential leak of this data could lead to secondary risks for the organization's clients, such as identity theft or targeted phishing attacks. When attackers gain access to internal documents and backups, they often use the information to craft more convincing social engineering campaigns against the company's partners or customers.

To defend against such threats, organizations in the technology and IT services sector typically focus on hardening their infrastructure. Common defensive steps include implementing multi-factor authentication (MFA) across all management interfaces, maintaining strict network segmentation to prevent lateral movement, and ensuring that backups are stored in an immutable or offline format to prevent them from being deleted or encrypted during an attack. Furthermore, continuous monitoring of system management infrastructure is essential to detect unauthorized access attempts in real-time.