rscn.org.jo Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 4 December 2024, the website rscn.org.jo, belonging to Jordan’s Royal Society for the Conservation of Nature, appeared on a leak site operated by the ransomware group funksec. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical details have not been disclosed.

Because the listing is a claim made by the group itself and has not been independently confirmed in the available record, the precise scope and impact of the incident are still limited. What is known so far is that a conservation organisation holding operational and administrative material has been named in connection with data theft and ransomware activity.

Inside the incident

According to the public listing, funksec claimed responsibility for a ransomware attack against rscn.org.jo and stated that internal files had been taken. The report date is 4 December 2024. No official confirmation from the organisation, no disclosure of the initial access method, no statement of encryption status, and no figure for the volume of data or number of individuals involved have been released in the available facts.

Public detail is therefore limited to the group’s assertion of exfiltration of internal files. Timing of the intrusion itself, the duration of any dwell time, and any ransom demand or negotiation are undisclosed. The incident is characterised solely as a ransomware event involving claimed data theft.

Inside funksec

Funksec is a ransomware operation that became publicly visible in late 2024. Like many contemporary groups, it follows a double-extortion model: encrypting systems where possible and simultaneously threatening to publish stolen data on a dedicated leak site if payment is not made. The group has been noted in open-source reporting for relatively rapid victim listings and for using automated or AI-assisted tooling in parts of its development and operations, though such descriptions remain general characterisations of its public activity rather than verified details of any single case.

Funksec typically posts short victim entries that name the organisation and assert that data has been exfiltrated. These listings function as pressure and advertising; they are claims, not independent verification. In the present case the group claims that internal files belonging to rscn.org.jo were taken. No further statements attributed to funksec about this specific victim appear in the provided record.

rscn.org.jo and its sector

The Royal Society for the Conservation of Nature (RSCN) is a Jordanian non-profit established in 1966. Its work centres on biodiversity conservation, the creation and management of nature reserves, sustainable development projects, and public environmental education. As a long-standing national conservation body it maintains relationships with government agencies, international partners, researchers, local communities and donors.

Organisations of this type routinely hold operational records, project documentation, staff and volunteer information, financial and donor data, research materials, and correspondence related to protected areas. A breach involving such an entity therefore raises concerns that extend beyond ordinary commercial data loss: sensitive ecological information, community engagement records and administrative files can all become exposed. The sector’s reliance on trust and long-term partnerships makes any confirmed compromise consequential for both the organisation’s mission and the people who interact with it.

The information in question

The available facts state only that “internal files” were exfiltrated. No inventory of file types, no confirmation of personal data categories, and no indication of whether employee, donor, partner or research records were included have been published. Exact contents therefore remain unconfirmed.

In the normal course of operations a conservation society of RSCN’s profile would be expected to hold staff and volunteer contact details, financial and grant records, project plans, mapping or survey data, and correspondence with government and community stakeholders. Whether any of those categories were among the files claimed by funksec is not established by the public record. Readers should treat the exposure as limited to the general description of internal files until further verified information appears.

What's at stake

For individuals whose details may have been present in internal systems, the practical risks include unwanted contact, phishing attempts that reference genuine organisational relationships, and potential misuse of personal or professional information. Because the scale is unknown, it is not possible to quantify how many people face these risks.

For the organisation itself the stakes include disruption of ongoing conservation work, possible exposure of sensitive project or partnership material, reputational harm that can affect donor and community trust, and the operational cost of investigation and recovery. Even when the precise data set is unconfirmed, the mere listing on a ransomware leak site can generate secondary effects such as increased scrutiny from partners and the need for heightened monitoring of related accounts and communications.

What to do if you're exposed

If you have a past or present connection with RSCN—as staff, volunteer, donor, partner or researcher—consider the following practical steps while official details remain limited:

• Monitor email and messaging accounts for unexpected messages that reference the organisation or its projects; treat unsolicited requests for credentials or payments with caution.
• Change passwords on any accounts that may have been used in connection with RSCN systems, and enable multi-factor authentication where available.
• Review financial and donation statements for unfamiliar activity if you have given money or personal details to the organisation.
• Be alert to social-engineering attempts that leverage knowledge of conservation work or Jordanian environmental initiatives.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in public dumps.

These measures do not depend on confirmation of specific file contents; they are standard precautions whenever an organisation with which you have dealt appears in a ransomware listing. Continue to follow any official notices issued by RSCN itself for the most authoritative guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.