myisp.live Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who rely on an internet service provider for connectivity at home or at work may find their personal or account-related information caught up in a reported data incident. On February 01, 2025, the organisation myisp.live was listed by the ransomware group funksec, which claims to have exfiltrated internal files during a ransomware attack. The number of people affected remains unknown, and public detail on the precise contents of those files is limited. For customers and staff, the practical stakes centre on whether any of that material could be used for fraud, account takeover, or further targeting.

What is known so far is confined to the group’s claim and the basic description of the organisation. No independent confirmation of the scale or full scope has been made public in the available record. That uncertainty itself is part of the risk: without clear notification, individuals cannot yet know whether their own data is involved.

Breaking down the breach

According to the reported listing, myisp.live was named by the funksec ransomware group on February 01, 2025. The group claims that internal files were exfiltrated in a ransomware attack. No further technical detail—such as the initial access method, the duration of any intrusion, the volume of data taken, or whether systems were encrypted—has been disclosed in the public facts. The number of people affected is listed as unknown.

Ransomware incidents of this type typically involve both encryption of systems and theft of data before a ransom demand is made. In this case, the only concrete assertion available is the group’s claim that internal files were removed. Whether those files have been published, sold, or retained as leverage is not stated. Readers should treat the listing as an unverified claim by the threat actor unless and until the organisation or independent investigators state the details.

Inside funksec

Funksec is a ransomware operation that became publicly visible in late 2024. Like many contemporary groups, it maintains a leak site on which it names alleged victims and, in some cases, posts samples or full archives of stolen data if a ransom is not paid. Public reporting has described the group as relatively new, often associated with lower ransom demands than older, more established ransomware brands, and occasionally noted for the use of automated or AI-assisted tooling in its operations. Its typical pattern follows the double-extortion model: encrypt systems and threaten to release or sell exfiltrated data.

None of that general background confirms the specific claims made about myisp.live. The group’s listing of the organisation is simply a claim that an attack occurred and that internal files were taken. No statements attributed to funksec beyond that listing appear in the available facts, and no independent verification of the claim is recorded here.

myisp.live and its sector

Myisp.live is described as a technology company specialising in information technology services related to internet service provision. Its offerings are said to include broadband, dial-up, and wireless internet connectivity aimed at both individual and business customers. Organisations in this sector sit at a critical junction: they manage network access, customer accounts, billing relationships, and often technical support records. Because connectivity is essential for daily life and commerce, an ISP or ISP-related provider typically holds data that can identify customers, link them to physical addresses or payment methods, and sometimes include technical logs or support tickets.

A breach affecting such an organisation is consequential for two reasons. First, the data an ISP holds can be used to impersonate customers or to map their online activity and physical locations. Second, disruption or compromise of internal systems can affect service reliability for many users at once. The available facts do not state that service outages occurred or that customer databases were confirmed stolen; they only record the claim of internal-file exfiltration. Still, the sector’s role makes any credible claim of compromise worth careful attention by those who use the service.

The information in question

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No inventory of file types, no count of records, and no confirmation of customer versus purely operational data have been provided. Exact contents therefore remain unconfirmed.

Organisations that provide internet services commonly hold customer names, contact details, service addresses, account numbers, billing and payment information, and technical records such as connection logs or support correspondence. They may also store employee records, internal network diagrams, configuration files, and commercial contracts. Any of those categories could fall under the broad label “internal files.” Because the public record does not specify which, if any, of these were taken, it is not possible to state as fact that particular data types belonging to customers or staff are in the hands of the attackers. The prudent assumption for anyone associated with the organisation is that sensitive material may have been involved until clearer information emerges.

The real-world impact

For individuals, the main risks are identity fraud, phishing that uses accurate personal details, and attempts to take over online accounts that share the same email address or password. Even if only internal operational files were allegedly stolen, those files can contain enough customer or employee identifiers to enable targeted social engineering. For the organisation, the consequences can include regulatory scrutiny, loss of customer trust, costs of investigation and remediation, and potential legal exposure if personal data was involved. Because the number of people affected is unknown and the precise data types are undisclosed, the full extent of harm cannot yet be measured.

There is also a secondary risk: once a ransomware group lists a victim, other criminals may attempt to exploit the publicity by launching phishing campaigns that impersonate the organisation or claim to offer “breach assistance.” People who receive unexpected messages about the incident should treat them with caution and verify through official channels.

If your data was in this claimed breach

If you are a customer or employee of myisp.live, begin by monitoring account statements and credit activity for unusual transactions. Change passwords on any accounts that share credentials with services linked to the organisation, and enable multi-factor authentication wherever it is available. Be alert for phishing emails or calls that reference the incident or request personal information. Keep records of any suspicious contact.

Because the full scope of the claimed exfiltration is not public, it is useful to check whether your email address has already appeared in other known breach data sets. Readers can run a free exposure scan of their email to see whether their information has surfaced in previously recorded breaches; that check does not confirm or deny involvement in this specific incident, but it provides a practical baseline for further precautions. Stay attentive to any official statements the organisation may issue, and follow guidance from trusted sources rather than unverified posts on social media or leak sites.

AICompiled with AI assistance from public sources and published under our editorial standards.