Funap Listed by Booba Project Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware crews continue to use public leak sites as pressure tools, posting company names and alleged haul sizes before any independent verification. In that setting, a listing is best read as an extortion claim, not as a finished investigation. On October 01, 2026, the group known as Booba Project listed Funap on its leak site, describing the firm in connection with government relations services and asserting that roughly 26 GB of material was involved. Funap has not publicly confirmed the claim as of writing. The number of people who might be affected, if any, remains unknown, and the listing does not spell out categories of personal or business records in a way outsiders can treat as an inventory.

For clients, partners, and individuals who deal with government-facing advisory firms, such a claim still warrants calm attention. Leak-site posts can be exaggerated, recycled, or false; they can also foreshadow later dumps if negotiations fail. What follows separates what the group asserts from what is simply unknown, and outlines practical steps that make sense whether or not the claim is eventually borne out.

What is being claimed

According to the listing, Booba Project has named Funap and framed the matter as involving stolen data tied to government relations services, with a stated volume of 26 GB. The public record supplied for this write-up does not describe how access was supposedly obtained, when any intrusion is said to have occurred, whether encryption was used on internal systems, or whether a ransom demand was issued. People affected are listed as unknown. Data types named as exposed are not disclosed beyond the group’s high-level marketing line about “stolen data” and the 26 GB figure.

No regulator notice, company statement, or independent breach index is included in the facts available here confirming that an incident took place. The listing should therefore be treated as Booba Project’s claim only. Timing beyond the October 01, 2026 report date of the listing, technical method, and exact file contents are undisclosed in the material provided for this article.

Who is Booba Project?

Booba Project is known publicly as a ransomware and extortion-style actor that, like many peers, relies on leak-site pressure: naming organisations, advertising alleged data volumes, and threatening publication to force payment or attention. Groups in this category commonly claim double extortion—disrupting operations while also asserting they hold copies of files—and use countdown-style pages or sample teases. Public reporting on such crews typically emphasises opportunistic targeting across sectors rather than a single industry niche, and often notes that claimed sizes and file descriptions are controlled by the attackers and are not audited inventories.

Nothing in the facts for this case adds victim-specific technical detail beyond the Funap listing itself. Claims the group makes about this organisation—such as the 26 GB figure and the government-relations framing—remain assertions on their site, not confirmed findings. Readers should not infer from a listing alone that every file advertised was taken from the named firm or that the volume is accurate.

Who is Funap?

Funap is identified in the listing material in connection with government relations services—work that generally means advising organisations on policy, public affairs, stakeholder engagement, and interactions with government bodies. Firms in that line of work typically handle client strategies, correspondence, calendars, contact lists, contracts, and internal notes that can touch political, commercial, and sometimes sensitive personal information about employees or third parties.

A leak-site claim against such a firm matters because trust and confidentiality sit at the centre of the service. Even an unverified accusation can raise questions for clients about whether their materials might be implicated if the claim were true. That consequence flows from the nature of the sector and from how extortion listings work, not from any confirmed breach narrative. Funap has not, on the information given here, publicly confirmed that an incident occurred.

What was likely exposed

The facts do not name specific data types as exposed; they are not disclosed beyond Booba Project’s claim of “stolen data” and a stated 26 GB volume tied to government relations services. It is therefore not established what, if anything, left Funap’s control.

If files from a government-relations practice were taken, organisations in this sector typically hold items such as client and prospect contact details, email and messaging archives, contracts and billing records, policy briefs and draft submissions, meeting notes, employee directories, and credentials or system exports that support day-to-day work. Those categories are sector norms, not a verified catalogue for this listing. Exact contents, whether personal data of private individuals was included, and whether the 26 GB claim matches real holdings remain unconfirmed. Treating the attackers’ description as a definitive inventory would overstate what a leak-site post can prove.

Why it matters

For people who work with or appear in the records of a government-relations firm, the practical risk—if the claim were accurate—would centre on misuse of business contact data, targeted phishing that references real projects or officials, exposure of negotiation positions, and secondary fraud using names, roles, or email addresses. Corporate clients could face reputational or competitive harm if strategy documents circulated. The organisation named on the listing faces operational and trust pressure regardless of eventual proof, because public accusation alone can unsettle partners.

At the same time, a listing does not by itself establish that any particular person’s data is in criminal hands. People affected are unknown in the available facts. Scale, sensitivity, and authenticity of the alleged 26 GB are controlled by the claimant. The responsible reading is conditional: monitor for social-engineering attempts that invoke Funap or related government-affairs work, and avoid assuming either that everything is fine or that a full dump is proven.

Steps worth taking either way

If you have a relationship with Funap or appear in government-relations correspondence that might touch such a firm, treat unsolicited messages that reference this listing with caution. Verify requests for money, credentials, or documents through a separate known channel. Prefer unique passwords and multi-factor authentication on email and cloud accounts you use for professional work. Watch financial and identity accounts for unusual activity if you have shared sensitive personal details with advisory firms in this space. If you are a client, ask your usual Funap contact—through established channels—what, if anything, the organisation is prepared to say publicly; do not rely solely on criminal leak sites for status.

These steps are prudent whether or not Booba Project’s claim is later confirmed. You can also run a free exposure scan of your email addresses to see whether your information has already appeared in other known breach datasets, which is a useful baseline even when a specific listing remains unverified. Public detail on this Funap listing is limited to the group’s claim, the October 01, 2026 report date, the government-relations framing, and the asserted 26 GB figure; anything beyond that should await confirmation from the company or independent authorities.

AICompiled with AI assistance from public sources and published under our editorial standards.