2sign.co.il Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 24 December 2024, the Israeli digital-signage firm 2sign.co.il appeared on a leak site operated by the ransomware group funksec. Public reporting states that the group claims to have exfiltrated internal files during a ransomware attack. The number of people affected remains unknown, and further technical detail about timing, method, or volume has not been released.

Because the listing is an unverified claim by the attackers, the precise scope of the incident is still unconfirmed. What is known is limited to the public notice itself and the nature of the business that was named.

Inside the incident

According to the available record, 2sign.co.il was listed by funksec on 24 December 2024. The group asserts that internal files were taken as part of a ransomware attack. No independent confirmation of the intrusion, no statement from the company, and no disclosure of the exact date of compromise or the quantity of data involved have been published. The number of individuals potentially affected is listed as unknown. In short, the public picture rests solely on the attackers’ claim that a ransomware operation resulted in the exfiltration of internal material.

Inside funksec

Funksec is a ransomware operation that has appeared on public monitoring lists in recent years. Like many contemporary groups, it typically follows a double-extortion model: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. Victims are routinely named on dedicated leak sites, often with sample files or brief descriptions intended to pressure the organisation. The group has been observed targeting a range of sectors rather than specialising in one industry. Its listings are claims; they do not by themselves prove the full extent of any given intrusion. In this case, the only assertion tied specifically to 2sign.co.il is the claim of internal-file exfiltration.

Who is 2sign.co.il?

2sign.co.il specialises in digital-signage solutions. The company designs, installs and manages display networks used by retailers, hospitality venues and corporate clients to deliver visual content and brand messaging. Organisations of this type commonly hold customer and partner contact details, project documentation, network-configuration records, billing information and internal operational files. A breach at such a firm can therefore affect not only the company’s own staff but also the businesses that rely on its systems for public-facing displays and related services. Because digital-signage platforms often sit on corporate networks or cloud environments, the potential reach of any compromised credentials or configuration data extends beyond the signage company itself.

The information in question

The public record states only that “internal files” were exfiltrated. No inventory of specific data categories—such as personal identifiers, financial records or authentication secrets—has been released. Companies that supply digital-signage services typically store employee records, client contracts, technical diagrams, remote-access credentials and marketing materials. Whether any of those categories were among the files claimed by funksec remains unconfirmed. Until a more detailed disclosure appears, the exact contents of the material must be treated as unknown.

What's at stake

For individuals whose details may have been present in the internal files, the practical risks include phishing that references genuine project or client information, credential-stuffing attempts if passwords or access tokens were stored, and possible social-engineering attacks aimed at staff or partner organisations. For 2sign.co.il itself, the consequences can include operational disruption, loss of client trust, regulatory scrutiny under applicable data-protection rules, and the cost of forensic investigation and remediation. Because the scale of the exposure is still undisclosed, the full impact cannot yet be measured; the absence of confirmed numbers does not eliminate the need for caution.

What to do if you're exposed

Anyone who has done business with 2sign.co.il or whose contact details may have been held by the firm can take a few immediate, practical steps:

• Change passwords for any accounts that may have been shared with or managed by the company, and enable multi-factor authentication where available.
• Watch for unexpected emails or messages that reference digital-signage projects, invoices or technical support; treat unsolicited requests for credentials or payments with scepticism.
• Review bank and credit statements for unfamiliar activity if financial details were ever supplied.
• Consider placing a fraud alert with credit bureaux if you believe sensitive personal data may have been involved.
• Run a free exposure scan of your email address against known breach data sets to see whether your information has already appeared in public dumps.

These measures do not require waiting for further official confirmation; they simply reduce the chance that any compromised material can be used against you. As more verified information becomes available, additional guidance may follow.

AICompiled with AI assistance from public sources and published under our editorial standards.