Funksec
Data as of August 16, 2026.
Credential exposure before the attack
21.7% of Funksec victims whose domain we can identify (35 of 161) had employee credentials leak in the 12 months before Funksec named them as a victim.
We don't know whether any of these credentials were how Funksec gained initial access.
What industries Funksec targets
Sector identified for 79 of 161 victims.
| Education | 16 | |
| Government | 13 | |
| Financial Services | 8 | |
| Technology | 8 | |
| Telecommunications | 5 | |
| Manufacturing | 5 | |
| Retail | 4 | |
| Healthcare | 4 |
Where the victims are located
Country identified for 68 of 161 victims.
| India | 13 | |
| Brazil | 8 | |
| United Arab Emirates | 4 | |
| France | 4 | |
| Italy | 3 | |
| Mexico | 3 | |
| Colombia | 3 | |
| Spain | 3 |
Most recent Funksec victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Semaphore semaphore.asso.fr | Not identified | France | Mar 19, 2025 |
| Sanirent sanirent.com.mx | Not identified | Mexico | Mar 17, 2025 |
| Extreme Performance extremeperformance.com | Manufacturing | Not identified | Mar 13, 2025 |
| University of Modena and Reggio Emilia unimore.it | Education | Italy | Mar 12, 2025 |
| The International School of Elite Education isee-eg.com | Education | Not identified | Mar 11, 2025 |
| K Labs klabs.it | Education | Italy | Mar 10, 2025 |
| Université de Rennes univ-rennes.fr | Not identified | France | Mar 10, 2025 |
| Sorbonne Université sorbonne-universite.fr | Education | France | Mar 7, 2025 |
| Desa Cimenyan cimenyan.desa.id | Not identified | Indonesia | Mar 4, 2025 |
| Laravel isurges.com | Government | Not identified | Mar 3, 2025 |
| J.A. Street jastreet.com | Construction | Not identified | Mar 3, 2025 |
| Mandarin mandarin.com.br | Not identified | Brazil | Mar 3, 2025 |
| MyTower mytower.com.br | Telecommunications | Brazil | Mar 3, 2025 |
| Moon Tech moontech.ae | Not identified | United Arab Emirates | Feb 27, 2025 |
| StayzApp stayzapp.in | Not identified | India | Feb 27, 2025 |
| Rossman Media rossmanmedia.ae | Not identified | United Arab Emirates | Feb 20, 2025 |
| Football Ticket Net footballticketnet.com | Not identified | Not identified | Feb 19, 2025 |
| Hiway Internet hiway.com.br | Not identified | Brazil | Feb 18, 2025 |
| Fast Track Cargo fasttrackcargo.com | Not identified | Not identified | Feb 17, 2025 |
| MyISP.live myisp.live | Telecommunications | Not identified | Feb 17, 2025 |
Showing the 20 most recent of 161. Browse recent data breaches for more.
Funksec leak sites
Addresses we've seen Funksec publish victims from. Any .onion address needs the Tor Browser.
7ixfdvqb4eaju5lzj4gg76kwlrxg4ugqpuog5oqkkmgfyn33h527oyyd.onionfunknqn44slwmgwgnewne6bintbooauwkaupik4yrlgtycew3ergraid.onionfastupload.iofunksec7vgdojepkipvhfpul3bvsxzyxn66ogp7q4pptvujxtpyjttad.onionfunksecsekgasgjqlzzkmcnutrrrafavpszijoilbd6z3dkbzvqu43id.onionfunkiydk7c6j3vvck5zk2giml2u746fa5irwalw2kjem6tvofji7rwid.onionfunkxxkovrk7ctnggbjnthdajav4ggex53k6m2x3esjwlxrkb3qiztid.onionfunksec53xh7j5t6ysgwnaidj5vkh3aqajanplix533kwxdz3qrwugid.onionfunkyiazgfsrxrib6rnxbhkgfqi7isisfbqnwk2ycf7tpgfhtevlamad.oniongofile.iofunk4ph7igelwpgadmus4n4moyhh22cib723hllneen7g2qkklml4sqd.onion
Funksec questions
Is Funksec still active?
Not for over a year. The last victim we recorded was March 19, 2025. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has Funksec claimed?
Funksec has named 161 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Funksec first appear?
The first victim we recorded for Funksec was posted on December 4, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Funksec target?
Education accounts for the most victims we can classify, with 16. Government follows at 13. We could identify a sector for 79 of 161 victims, so treat this as the shape of the targeting rather than a full census.
Has Funksec already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.