egyptair.com 5 with 10K ! Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target large organisations whose operations depend on complex digital systems and hold large volumes of operational and customer-related data. Listings on criminal leak sites form part of a familiar double-extortion pattern in which actors claim to have stolen files and threaten public release. One such listing, reported on 23 December 2024, names an entity associated with EgyptAir and attributes the incident to the group funksec.

Public detail remains limited. The listing itself is a claim by the group rather than an independently verified confirmation of compromise, and the number of people affected has not been disclosed. What is known is that the claim involves the exfiltration of internal files in a ransomware attack. For passengers, employees and partners of a national airline, even an unconfirmed claim warrants careful attention because of the types of information such organisations typically process.

What happened

According to the available record, the organisation listed as “egyptair.com 5 with 10K !” appeared on a funksec leak site on 23 December 2024. The group claims that internal files were exfiltrated during a ransomware attack. No further technical detail has been made public about the initial access method, the duration of any intrusion, the precise volume of data taken, or whether encryption of systems also occurred. The number of individuals whose information may have been involved is unknown. Independent confirmation of the claim has not been reported in the material available for this account; the listing therefore stands as an assertion by the threat actor.

The group behind it: funksec

Funksec is a ransomware operation that has appeared in public reporting in late 2024. Like many contemporary groups, it follows a double-extortion model: actors claim to steal data before or instead of encrypting systems, then list the victim on a dedicated leak site to increase pressure for payment. Public descriptions of the group note that it has claimed multiple victims across different sectors in a relatively short period and that some of its tooling has been associated with automated or AI-assisted development, though such claims about tooling are themselves often difficult to verify independently. The group’s leak-site posts typically assert that internal documents and databases have been taken; those assertions remain claims until corroborated by the victim organisation or by forensic evidence made public. In this case, the listing of the EgyptAir-related entity is presented solely as funksec’s claim.

egyptair.com 5 with 10K ! and its sector

EgyptAir is Egypt’s national airline, headquartered in Cairo and established in 1932. It operates scheduled passenger and cargo services to destinations across the Middle East, Europe, Africa, Asia and the Americas and is a member of the Star Alliance. Airlines of this scale maintain extensive digital infrastructure covering reservations, check-in, crew scheduling, aircraft maintenance records, cargo tracking, frequent-flyer programmes and corporate systems. They also handle large volumes of personal data belonging to passengers and staff, as well as commercially sensitive operational information. A successful ransomware incident against such an organisation can therefore affect flight operations, customer trust and regulatory obligations, even when the precise scope of any data loss remains unconfirmed.

The information in question

The only data category named in the available record is “internal files” said to have been exfiltrated in a ransomware attack. No inventory of specific file types, databases or record counts has been released. Organisations in the airline sector typically hold passenger booking and contact details, passport and travel-document information, payment-related records, employee personnel files, maintenance and safety documentation, and commercial contracts. Whether any of those categories were among the files claimed by funksec is unconfirmed. Readers should treat any assertion about particular data elements as speculative until the organisation itself or a competent authority provides verified detail.

Why it matters

For individuals, the principal risk is that personal or travel-related information, if it was among the stolen files, could later appear in criminal marketplaces or be used for fraud, phishing or identity-related misuse. Even without confirmation of specific records, the mere claim can generate targeted social-engineering attempts that reference the airline. For the organisation, a ransomware claim can disrupt operations, impose recovery costs, trigger regulatory notification duties and damage reputation among passengers and partners. Because the number of people affected remains unknown and the exact contents of the files are undisclosed, the full scale of residual risk cannot yet be measured. Calm monitoring of official statements from EgyptAir and relevant authorities is therefore the most reliable way to obtain accurate updates.

If your data was in this claimed breach

If you have flown with EgyptAir, hold a frequent-flyer account, or have other dealings that would place your information in the airline’s systems, treat the listing as a prompt for basic hygiene rather than proof of compromise. Change passwords on any related accounts, enable multi-factor authentication where available, and watch for unexpected messages that claim to come from the airline or that request personal details. Monitor financial statements for unusual activity. Because the precise data involved has not been confirmed, free exposure-scanning services that check whether an email address appears in known breach corpora can provide an additional, low-effort indicator of whether your address has surfaced elsewhere. Official notifications from EgyptAir or from data-protection authorities, if and when they are issued, remain the authoritative source of guidance for anyone whose information may have been affected.

AICompiled with AI assistance from public sources and published under our editorial standards.