mtgazeta.uz Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who interact with online news platforms in Uzbekistan may find their personal details, account information, or other records caught up in a claimed data incident involving mtgazeta.uz. When internal files are said to have been taken in a ransomware attack, the practical concern is straightforward: material that was never meant for public view could surface, creating risks of unwanted contact, identity misuse, or further targeting for those whose data appears in it.

Public reporting on 6 December 2024 noted that the site mtgazeta.uz had been listed by the ransomware group funksec. The number of people affected remains unknown, and the precise contents of any taken material have not been independently confirmed. What is known is limited to the group's claim that internal files were exfiltrated.

Inside the incident

According to the available record, mtgazeta.uz was listed by the funksec ransomware group on or around 6 December 2024. The listing asserts that internal files were exfiltrated as part of a ransomware attack. No further technical details—such as the initial access method, the exact date of intrusion, the volume of data, or any ransom demand—have been disclosed in the public summary. The number of individuals whose information may be involved is listed as unknown. Independent verification of the claim has not been reported, so the listing itself stands as an assertion by the group rather than a confirmed forensic finding.

In ransomware incidents of this type, attackers typically encrypt systems and threaten to publish stolen data if payment is not made. Here, the only concrete statement provided is that internal files were taken. Timing beyond the reporting date, the scale of any compromise, and whether systems were restored or ransoms paid remain undisclosed.

The group behind it: funksec

Funksec is a ransomware operation that has appeared in public threat reporting as a group that conducts double-extortion attacks: encrypting victim systems while also stealing data and threatening to leak it on dedicated sites. Like other such actors, it typically posts victim names and sometimes sample files to pressure organisations into paying. Its listings are claims made by the group itself; they are not automatically verified by independent investigators.

Public knowledge of funksec indicates it has targeted a range of organisations across different sectors and regions, using common ransomware tactics such as phishing or exploitation of exposed services to gain entry, followed by data theft and encryption. No specific statements by funksec about mtgazeta.uz beyond the listing itself are recorded in the facts provided. Therefore any assertion that particular files or quantities of data were taken should be treated as the group's claim until corroborated.

About mtgazeta.uz

MTGazeta.uz operates as an online news and information portal based in Uzbekistan. It publishes local and international news, business coverage, cultural material and related content aimed at a broad readership inside the country. Organisations of this kind typically maintain websites, content-management systems, subscriber or comment databases, staff email accounts, advertising records and internal editorial or administrative files.

A claimed breach at a news platform carries weight because such sites often hold contact details of readers, contributors and partners, as well as internal documents that may include unpublished material or operational records. Even when the exact data set is unknown, the combination of public-facing digital services and internal systems makes the organisation a potential source of both personal and institutional information if files are taken.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack. No specific categories—such as names, email addresses, passwords, financial records or editorial drafts—are named. Because the precise contents remain undisclosed, it is not possible to confirm what was taken.

News organisations of this type commonly hold staff directories, contributor contact lists, subscriber or newsletter data, advertising contracts, content archives and system configuration files. Any of these could fall under the broad label “internal files.” Until more detail is released or independently verified, the exact nature of the material must be regarded as unconfirmed.

What's at stake

For individuals whose information may appear in the claimed files, the main risks are practical rather than dramatic: unwanted emails or calls, attempts to reuse credentials on other services, or social-engineering attempts that reference the news site. If contact details or account data were present, those records could be combined with other breaches to increase the chance of fraud. The scale of any such exposure is unknown, so the number of people facing these risks cannot be stated.

For the organisation itself, a ransomware listing can disrupt operations, damage reader trust and create regulatory or reputational pressure. Even if systems are restored, the possibility that internal files remain in the hands of the attackers leaves open the chance of later publication or further misuse. Because the facts do not confirm whether data has been released or whether the claim has been validated, the full extent of operational impact stays unconfirmed.

Were you affected?

If you have an account, subscription or regular contact with mtgazeta.uz, treat the possibility of exposure as real until more information appears. Change any passwords used on the site, enable multi-factor authentication where available, and watch for unexpected messages that reference the platform. Monitor financial and email accounts for unusual activity. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Public detail on this incident remains limited; further official statements from the organisation or independent researchers would be needed to clarify the true scope.

AICompiled with AI assistance from public sources and published under our editorial standards.