thecitybank.com Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to list organisations on dark-web leak sites as a core pressure tactic in 2025, turning claims of data theft into public leverage even when independent confirmation remains limited. On 21 January 2025 thecitybank.com appeared among those listings, attributed to the funksec ransomware group. Public detail is sparse: the number of people affected is unknown, and only the broad category of internal files is described as having been taken. For customers, employees and partners of a commercial bank, any such claim still carries practical weight because financial institutions hold sensitive personal and transactional records by design.

This article sets out only what has been reported, places the claim in context, and outlines the concrete steps people can take while fuller verification is pending.

What happened

According to the available record, thecitybank.com was listed by the funksec ransomware group on 21 January 2025. The listing characterises the incident as a ransomware attack in which internal files were allegedly exfiltrated. No further operational details—such as the precise date of intrusion, the initial access vector, the volume of data removed, or whether encryption was also deployed—have been disclosed in the public summary. The number of individuals whose information may have been involved is listed as unknown. Because the primary source is a threat-actor leak-site claim, the listing itself remains an unverified assertion until corroborated by the organisation or independent investigators.

No ransom demand figure, no sample file dumps, and no timeline of negotiations have been made public in the material provided. The incident is therefore known only at the level of the group’s assertion that internal files were taken during a ransomware operation against thecitybank.com.

The group behind it: funksec

Funksec is a ransomware operation that has attracted attention for its use of double-extortion tactics: data are first stolen and then encryption is threatened or applied, with the stolen material used as leverage on a dedicated leak site. Public reporting on the group notes that it has claimed multiple victims across sectors and has been observed employing tools and code that appear to incorporate generative-AI assistance for development and negotiation language. Like other contemporary ransomware crews, funksec typically posts victim names, sometimes accompanied by file counts or screenshots, to increase pressure and to advertise its capabilities to potential affiliates.

In the present case the group claims that thecitybank.com suffered an attack resulting in the exfiltration of internal files. No additional statements attributed specifically to funksec about this victim—such as unique demands, alleged security failures, or precise data volumes—appear in the facts available. The listing should therefore be treated as the group’s assertion rather than as independently verified fact.

Who is thecitybank.com?

thecitybank.com is the online presence of City Bank, one of the older private commercial banks operating in Bangladesh. The institution provides retail banking, SME financing, credit-card services, treasury operations and corporate banking. Like most commercial banks it relies on digital channels for customer transactions, account management and internal record-keeping, and it has publicly emphasised technology adoption and product diversification as part of its growth strategy.

A bank of this type routinely processes and stores customer identity documents, account numbers, transaction histories, credit information, employee records and corporate client data. Any credible claim that internal files have left its control therefore raises immediate questions about the confidentiality of those records and about potential secondary misuse, even when the exact scope remains unconfirmed.

What data was at risk

The only data category named in the public record is “internal files” said to have been exfiltrated in a ransomware attack. No inventory of specific file types, no count of records, and no confirmation of whether customer, employee or purely operational material was involved have been released. Because the precise contents are undisclosed, it is not possible to state as fact that particular categories of personal data were exposed.

Organisations in the commercial-banking sector typically hold large volumes of personally identifiable information, financial account details, credit histories, contact data and internal business documents. Until City Bank or independent forensic analysis publishes a verified list, any assumption that those typical holdings were among the taken files remains speculative. The known claim is limited to the exfiltration of internal files.

What's at stake

For individuals whose data may have been among the internal files, the practical risks include targeted phishing that references genuine account or transaction details, identity-fraud attempts that exploit leaked personal identifiers, and the longer-term possibility that credentials or financial information could be sold or reused. Because the number of affected people is unknown, the scale of any such exposure cannot yet be quantified.

For the bank itself the stakes include regulatory scrutiny under Bangladesh’s financial-sector rules, potential notification obligations to customers and authorities, reputational damage that can erode trust in digital channels, and the operational cost of investigation, containment and remediation. Even an unverified listing can prompt customers to change passwords, monitor statements more closely, and question the security of online banking services. None of these consequences require the claim to be proven true; the mere public assertion creates friction that the organisation must manage.

What to do if you're exposed

If you hold an account or have otherwise shared personal information with City Bank, treat the listing as a prompt for basic hygiene rather than as confirmed proof of compromise. Review recent account statements and credit-card activity for unfamiliar transactions. Change online-banking and email passwords, enabling multi-factor authentication wherever it is offered. Be alert to unexpected messages that claim to come from the bank and that request credentials or urgent action; verify any such contact through official channels you initiate yourself.

Consider placing a fraud alert with credit-reporting services if you are concerned about identity misuse. Finally, you can run a free exposure scan of your email address against known breach data sets to see whether that address has already appeared in other publicly documented incidents; such a check does not confirm or refute the present claim, but it supplies an additional data point for personal risk assessment while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.