qed.co.ug Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a recruitment platform that handles job applications, CVs and employer records appears on a ransomware group's listing, the people most directly affected are job seekers and hiring managers whose personal and professional details may have been copied. Public reporting places qed.co.ug on the funksec leak site as of 27 January 2025; the number of individuals involved remains unknown and the precise contents of the files have not been independently confirmed.

For anyone who has used the site to apply for work or to post vacancies, the practical stakes are straightforward: contact information, employment history and other internal records could be in the hands of criminals who specialise in extortion. This article sets out only what is known from the available record, without speculation.

Breaking down the breach

According to the public listing, the domain qed.co.ug was claimed by the funksec ransomware group on 27 January 2025. The group states that internal files were exfiltrated during a ransomware attack. No independent confirmation of the intrusion method, the exact date of the compromise, the volume of data taken, or the number of people affected has been published. The scale of the incident is therefore undisclosed.

Ransomware operations of this type typically involve encrypting systems and simultaneously copying data for leverage. In this case the only concrete claim available is that internal files were removed. Whether any ransom demand was issued, paid or refused is not part of the public record.

The group behind it: funksec

Funksec is a ransomware operation that has appeared on public leak sites in recent years. Like many groups of its kind, it follows a double-extortion model: systems are encrypted and stolen data is threatened with publication unless a payment is made. Victims are routinely listed on dedicated leak portals, often with sample files or screenshots offered as proof of access.

The group's public activity has focused on organisations across multiple sectors and regions. Its listings are claims made by the actors themselves; they do not constitute verified proof that every named organisation was successfully breached or that every file described was in fact taken. In the present case, the listing of qed.co.ug should be treated as an unverified claim by funksec unless further evidence emerges.

Who is qed.co.ug?

QED Solutions Ltd operates the website qed.co.ug, a Ugandan-based recruitment platform that connects employers with potential employees. The company provides human-resource services including recruitment, consultancy and training. It works across sectors such as finance, information technology, sales, and oil and gas, serving organisations that need workforces of varying sizes.

Recruitment platforms of this kind routinely process CVs, contact details, educational and employment histories, and sometimes identity documents or references. They also hold employer account information and internal correspondence related to hiring. A breach affecting such a service therefore carries consequences both for individual job seekers and for the companies that rely on the platform.

The information in question

The only data type named in the public summary is “internal files exfiltrated in a ransomware attack.” No further breakdown—such as whether the files included candidate databases, payroll records, contracts or system credentials—has been disclosed. Exact contents remain unconfirmed.

Organisations that operate recruitment platforms typically store personal data submitted by applicants (names, email addresses, phone numbers, work history) and business data belonging to client employers. Until more detailed inventories are published by the company or by independent researchers, it is not possible to state with certainty which of these categories, if any, were among the files claimed by funksec.

The real-world impact

For individuals, the main risks are identity misuse, targeted phishing and unsolicited contact. Contact details and employment histories can be used to craft convincing messages that appear to come from legitimate recruiters or past employers. For the organisation itself, the consequences may include operational disruption, loss of client confidence and regulatory scrutiny under data-protection rules applicable in Uganda and any other jurisdictions where the data subjects reside.

Because the number of people affected is unknown and the precise data types remain undisclosed, the full extent of harm cannot yet be measured. The listing alone, however, is enough to place both job seekers and client companies on alert.

If your data was in this claimed breach

If you have ever created a profile, submitted a CV or corresponded through qed.co.ug, treat the possibility of exposure seriously even while details remain limited. Practical first steps include:

• Change any password you reused on the platform and enable multi-factor authentication wherever it is offered.
• Watch for unexpected emails or messages that reference past job applications or claim to be from QED Solutions; verify them through official channels before clicking links or opening attachments.
• Monitor bank and credit accounts for unusual activity if you previously supplied financial or identity documents.
• Consider placing a fraud alert with relevant credit-reference agencies if you are concerned about identity theft.
• Run a free exposure scan of your email address against known breach data sets to see whether your information has already appeared in other incidents.

Public detail on this particular incident remains limited. Further updates, if any, will depend on statements from QED Solutions Ltd or independent verification of the files claimed by funksec. Until then, caution and basic hygiene remain the most useful responses.

AICompiled with AI assistance from public sources and published under our editorial standards.