stayzapp.in Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 28, 2025, the Indian short-stay rental platform stayzapp.in was listed by the ransomware group funksec. Public reporting indicates that internal files were exfiltrated during a ransomware attack. The number of people affected remains unknown, and further technical details about the intrusion have not been disclosed.

The listing itself is a claim published by the group on its leak site. Until independent confirmation or official statements emerge, the precise scope and verification of the incident rest on that claim and the limited facts available so far. For users and property owners who rely on the service, the episode raises practical questions about what information may have been exposed and what steps to take next.

Inside the incident

According to available records, stayzapp.in appeared on a funksec leak-site listing dated February 28, 2025. The only data category named in connection with the event is internal files said to have been exfiltrated as part of a ransomware attack. No figure has been published for the volume of data, the number of systems involved, or the number of individuals whose information may have been included. Timing of the initial intrusion, the entry vector, and whether encryption of production systems occurred alongside the exfiltration are all undisclosed.

Ransomware incidents of this type typically involve unauthorized access followed by data theft and a threat to publish or sell the material if a ransom is not paid. In this case, public detail stops at the group’s claim that internal files were taken. No independent forensic report, company confirmation, or regulatory filing has been cited in the material available for this account, so the listing remains an unverified claim rather than a fully corroborated breach disclosure.

The group behind it: funksec

Funksec is a ransomware operation that became publicly visible in late 2024. It is known for double-extortion tactics: encrypting systems where possible while simultaneously stealing data and threatening to release it on a dedicated leak site. The group has been noted in open-source reporting for claiming to incorporate artificial-intelligence tools into aspects of its ransomware development and for listing victims across multiple sectors and geographies. Its public communications often consist of short victim announcements accompanied by sample files or screenshots intended to pressure payment.

Like other contemporary ransomware crews, funksec relies on the credibility of its leak-site postings to create leverage. A listing does not by itself prove that every claimed file set is authentic or complete; it is an assertion by the attackers. In the stayzapp.in case, the group claims responsibility for the exfiltration of internal files. No additional statements attributed specifically to this victim—such as ransom demands, file counts, or deadlines—appear in the facts provided, and none should be assumed.

About stayzapp.in

Stayzapp.in is an Indian online platform that enables homeowners and property managers to list residential spaces for short- or long-term rental. The service is aimed at travelers and temporary residents seeking holiday homes, guest houses, and serviced apartments, while offering hosts a channel to monetize unused or under-used property. Its interface is designed for straightforward listing by owners and booking by guests.

Platforms of this kind sit at the intersection of hospitality, real estate, and consumer technology. They routinely process account credentials, contact details, booking histories, payment-related information, property addresses, and communications between hosts and guests. Because the business model depends on trust between strangers who share living spaces, any compromise of internal systems can affect both the commercial reputation of the platform and the personal safety and privacy of the people who use it. A ransomware incident therefore carries consequences beyond pure data loss; it can disrupt bookings, erode user confidence, and expose operational records that were never intended for public view.

What data was at risk

The facts name only “internal files exfiltrated in ransomware attack.” No inventory of specific data types—such as customer names, email addresses, phone numbers, identity documents, payment card data, property addresses, or host banking details—has been published. The exact contents of the exfiltrated material therefore remain unconfirmed.

Organizations operating short-stay rental marketplaces typically hold a mixture of account registration data, reservation records, messaging logs, property descriptions and photographs, and administrative or financial files needed to run the business. Internal files could encompass any of those categories, or they could be limited to operational documents with little personal information. Because the public record does not specify which files were taken, it is not possible to state with certainty what personal or commercial data, if any, left the company’s control. Readers should treat any more granular claims circulating online as unverified unless corroborated by the company or by independent analysis of released samples.

The real-world impact

For individuals whose information may have been among the internal files, the practical risks include unwanted contact, phishing attempts that reference genuine booking or property details, and, in the worst case, misuse of identity or financial data if such records were present. Hosts could face exposure of personal addresses or banking information used for payouts; guests could see reservation histories or contact details surface in criminal markets. Even when the precise data set is unknown, the mere possibility of leakage creates lasting uncertainty for anyone who has used the platform.

For stayzapp.in itself, the incident carries operational and reputational costs. Restoring systems after ransomware, investigating the intrusion, and communicating with users and regulators consume time and resources. Trust is central to a marketplace that matches private homes with temporary occupants; public association with a ransomware listing can deter both new hosts and travelers. The absence of a confirmed count of affected people does not eliminate these pressures; it simply leaves the scale of remediation and notification work undefined for now.

If your data was in this claimed breach

If you have an account with stayzapp.in or have listed or booked property through the platform, treat the situation as a potential exposure of internal records until clearer information appears. Change your password on the site and on any other service where you reused the same credentials. Enable multi-factor authentication wherever it is offered. Monitor email and SMS for unexpected messages that reference stays, properties, or payments, and avoid clicking links or opening attachments from unfamiliar senders. Review bank and card statements for unauthorized activity if you have stored payment methods with the service.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Keep records of any suspicious contact and consider placing fraud alerts with credit bureaus if you believe sensitive identity information may have been involved. Official updates from the company, if and when they are issued, remain the most reliable source for confirmation of what was actually taken and who needs to take further action.

AICompiled with AI assistance from public sources and published under our editorial standards.