itc.gov.ae with 1K ! Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 24 December 2024 the Integrated Transport Centre of Abu Dhabi, operating under the domain itc.gov.ae, appeared on a listing published by the ransomware group funksec. The group claims it carried out a ransomware attack and exfiltrated internal files. For anyone who has dealt with land-transport licensing, public-transport services or traffic regulation in the emirate, the practical question is straightforward: whether personal or operational records held by the centre could now be circulating beyond official control.

Public detail remains limited. The number of people affected is unknown, and the precise contents of the files have not been independently verified. What is known is that a government body responsible for everyday mobility services has been named in a ransomware claim, and that claim must be treated with care until further confirmation emerges.

What happened

According to the available record, funksec listed itc.gov.ae with the notation “1K !” on 24 December 2024. The listing characterises the incident as a ransomware attack in which internal files were allegedly exfiltrated. No further technical details—such as the initial access vector, the encryption status of systems, the exact volume of data taken, or any ransom demand—have been disclosed in the public facts. The number of individuals potentially affected is recorded as unknown. The listing itself constitutes a claim by the group; it has not been independently confirmed by the organisation or by official investigators in the material provided.

The group behind it: funksec

Funksec is a ransomware operation that has appeared on public leak sites in recent years. Like many contemporary ransomware groups, it typically follows a double-extortion model: encrypting systems while also claiming to steal data, then threatening to publish the material if payment is not made. The group maintains a dedicated leak site where it posts victim names, sometimes accompanied by sample files or volume claims, in an effort to increase pressure. Its activity has been documented across multiple sectors, though the precise tools, affiliates and internal structure remain subjects of ongoing research by security firms. In this instance the only specific assertion available is the group’s own listing of itc.gov.ae and the statement that internal files were exfiltrated; no additional claims unique to this victim appear in the facts.

itc.gov.ae with 1K ! and its sector

The domain itc.gov.ae belongs to the Integrated Transport Centre (ITC) of Abu Dhabi, the government entity charged with regulating and managing land transport and traffic across the emirate. Its responsibilities include the development of efficient transport systems, traffic-safety programmes, and the oversight of public-transport services such as buses and taxis. The centre works toward sustainable and innovative mobility solutions for residents and visitors. Organisations of this type routinely handle operational data, licensing records, vehicle and driver information, route planning materials, and correspondence with contractors and the public. Because transport infrastructure underpins daily life and economic activity, any disruption or data exposure at such a body carries consequences that extend beyond the organisation itself to the broader community that relies on its services.

What data was at risk

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data categories—such as names, identification numbers, financial details, or technical schematics—has been released. Public detail on the exact contents is therefore unconfirmed. In general, a transport regulator of this kind would be expected to hold staff records, contractor contracts, vehicle-registration or licensing databases, incident reports, and internal planning documents. Whether any of those categories were among the files claimed by funksec cannot be established from the available information, and readers should treat any assumption about particular data types as speculative until official clarification is provided.

The real-world impact

If internal files have indeed left the organisation’s control, the immediate risks for individuals include the possible misuse of personal details that may appear in licensing, employment or correspondence records. Even limited personal data can be combined with other sources to support phishing, social-engineering attempts or identity-related fraud. For the organisation itself, the consequences may include temporary operational disruption, the cost of forensic investigation and system restoration, and the need to notify regulators and affected parties under applicable data-protection rules. Because the scale of the claimed exfiltration remains unknown, the full extent of these effects cannot yet be measured. The listing also creates a period of uncertainty during which both the public and the organisation must operate without complete information.

Were you affected?

If you have interacted with the Integrated Transport Centre—through vehicle licensing, public-transport accounts, employment, or contractor relationships—consider taking basic protective steps. Monitor financial and email accounts for unexpected activity, enable multi-factor authentication where available, and treat unsolicited messages that reference transport services with caution. Official confirmation of any data exposure may take time; until then, the prudent course is heightened vigilance rather than panic. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets, providing one additional indicator of whether their information has circulated more widely.

AICompiled with AI assistance from public sources and published under our editorial standards.