mandarin.com.br Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 28, 2025, the Brazilian technology firm mandarin.com.br appeared on a listing published by the ransomware group known as funksec. Public reporting indicates that internal files were exfiltrated during a ransomware attack, though the number of people affected remains unknown and many operational details have not been disclosed. The listing itself constitutes a claim by the group rather than independently verified confirmation of every asserted element.

For customers, partners and employees of a company that supplies digital tools such as email marketing platforms, eCommerce management systems and customer-relationship software, any confirmed or claimed exposure of internal material raises practical questions about data security and residual risk. What is known so far is limited; what follows examines those facts without speculation.

Inside the incident

According to available public information, mandarin.com.br was listed by funksec on or around February 28, 2025. The reported summary states that internal files were exfiltrated in the course of a ransomware attack. No figure for the volume of data, no inventory of specific file names or systems, and no confirmed timeline of initial access or encryption have been released in the material provided. The number of individuals whose information may have been involved is listed as unknown. Method of intrusion, ransom demand amount if any, and whether encryption was successfully deployed or reversed remain undisclosed. The sole concrete assertion is the group’s claim that internal files left the organisation’s control.

The group behind it: funksec

Funksec is a ransomware operation that became publicly visible in late 2024. Like many contemporary groups, it typically employs a double-extortion model: data are stolen before systems are encrypted, and victims are threatened with public release if payment is not made. The group maintains a leak site on which it posts victim names and, in some cases, sample files or larger archives. Public reporting has associated funksec with relatively rapid victim listings, occasional use of automated or AI-assisted tooling, and a focus on mid-sized organisations across multiple sectors and geographies. Prior activity documented by security researchers includes claims against companies in technology, manufacturing and services. In the present case the group claims mandarin.com.br as a victim and asserts that internal files were taken; those assertions have not been independently corroborated in the facts available here and should be treated as unverified claims.

Who is mandarin.com.br?

Mandarin.com.br is a Brazilian company that supplies technology solutions to individual customers, corporations and other businesses. Its publicly described offerings include email-marketing programmes, tools for managing eCommerce platforms to improve online sales performance, and customer-relationship management systems. Organisations of this type routinely handle business contact lists, campaign performance data, order and inventory records, and authentication credentials for the platforms they administer. Because the firm sits between its clients and their digital marketing and sales infrastructure, a compromise can affect not only the company’s own internal operations but also the data and systems of the organisations that rely on its services. That intermediary position is why a claimed ransomware incident at such a provider carries wider consequence than a purely internal corporate breach.

The information in question

The facts state that internal files were exfiltrated. No further breakdown of file types, databases or personal-data categories has been disclosed. Technology firms that operate email-marketing, eCommerce and CRM platforms typically store client contact records, campaign histories, transaction metadata, configuration files, API keys and internal administrative documents. Whether any of those categories were among the material allegedly taken from mandarin.com.br is unconfirmed. Public detail is limited to the generic description “internal files.” Readers should therefore treat any more specific characterisation as speculative until additional verified information appears.

The real-world impact

For individuals whose data may have been present in the exfiltrated material, the principal risks are secondary misuse of contact details, phishing that leverages knowledge of prior business relationships, and credential-stuffing attempts if login information was stored. For client companies that used mandarin.com.br’s platforms, possible consequences include disruption of marketing campaigns, temporary loss of access to managed eCommerce or CRM environments, and the need to rotate credentials or review third-party integrations. The organisation itself faces operational recovery costs, potential contractual notifications to customers, and reputational scrutiny. Because the scale of the exfiltration and the precise contents remain unknown, the actual severity for any given person or client cannot yet be quantified; the prudent assumption is that some internal material left the company’s control and that residual risk persists until further clarity emerges.

Were you affected?

If you are a customer, employee or partner of mandarin.com.br, treat the incident as a prompt to review recent account activity and to change passwords on any services that shared credentials or integrations with the firm. Enable multi-factor authentication where available and monitor email and financial accounts for unexpected messages that reference past campaigns or transactions. Organisations that relied on the company’s platforms should inventory connected systems, rotate API keys and review access logs. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a check provides one additional data point but does not replace direct communication from mandarin.com.br or competent authorities if formal notifications are issued.

AICompiled with AI assistance from public sources and published under our editorial standards.