uniaomarmores Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a company that handles stone extraction and commercial projects appears on a ransomware group's leak site, the practical concern is straightforward: internal files may have left the organisation's control, and anyone whose details sit inside those systems could face follow-on risks. Public reporting places the listing of uniaomarmores by the funksec ransomware group on 4 December 2024. The number of people affected remains unknown, and the only data category named is internal files said to have been exfiltrated during a ransomware attack. For customers, suppliers, employees or partners, that limited disclosure still raises the ordinary questions of whether personal or business information may now be circulating and what steps make sense next.

Exact confirmation of the intrusion, the volume of material taken, or any ransom demand has not been published in the available record. The listing itself is a claim by the group; independent verification of the breach has not been detailed in the facts provided. What follows is a careful account of what is known, the actor involved, the organisation, and the realistic implications for anyone who may be connected to it.

Inside the incident

According to the reported information, uniaomarmores was listed by the funksec ransomware group on 4 December 2024. The group claims that internal files were exfiltrated as part of a ransomware attack. No further technical detail—such as the initial access method, the encryption status of systems, the precise date of the intrusion, or the quantity of data removed—has been disclosed in the public summary. The number of individuals whose information may be involved is listed as unknown. Because the only source for the event is the group's own leak-site claim, the incident should be treated as an unverified assertion until the organisation or independent investigators state it. No statements from uniaomarmores itself appear in the available facts, and no dollar figures, file counts or sample data have been released.

Inside funksec

Funksec is a ransomware operation that became publicly visible in late 2024. Like many contemporary groups, it follows a double-extortion model: data is stolen before systems are encrypted, and the threat of publication is used to pressure victims. The group maintains a leak site where it posts victim names and, in some cases, samples or full archives of claimed stolen material. Public reporting has noted that funksec has marketed itself as employing artificial-intelligence assistance in code generation and operational tasks, though such claims are self-reported and not independently audited. The group has listed organisations across multiple sectors and geographies, typically without providing exhaustive technical indicators of compromise. Its listings are therefore best understood as assertions rather than verified forensic findings. Nothing in the public record of this specific case attributes any unique statement by funksec about uniaomarmores beyond the basic claim of internal-file exfiltration.

Who is uniaomarmores?

Uniaomarmores, also referred to as União Mármores, is a company specialising in the extraction, processing and distribution of marble and other natural stones. It supplies products for residential and commercial construction projects and positions itself around quality and customised stone solutions. Organisations of this type routinely maintain records of customers, suppliers, logistics partners, employees and financial transactions. They also hold operational data such as inventory, project specifications, contracts and internal correspondence. A ransomware incident affecting such a firm is consequential because the data held is not limited to public marketing material; it can include commercially sensitive details and personal information belonging to people who do business with, or work for, the company. The sector itself is not immune to cybercrime: manufacturing and materials businesses often operate with industrial systems and partner networks that expand the potential attack surface, though no specific vulnerability has been identified in the facts of this case.

What was likely exposed

The only data type named in the available facts is “internal files exfiltrated in ransomware attack.” No inventory of those files, no confirmation of personal identifiers, financial records, credentials or project documents, and no sample contents have been published. Exact contents therefore remain unconfirmed. Companies engaged in stone extraction and distribution typically store customer contact details, order histories, supplier contracts, employee records, invoices and operational documents. Any of those categories could theoretically be present among internal files, yet it would be inaccurate to state that any particular class of data was taken. Until the organisation or a competent forensic review releases a verified list, the exposure must be described only as internal files of unknown composition and volume.

The real-world impact

For individuals whose information may sit inside the claimed files, the practical risks are the ordinary ones associated with any unauthorised disclosure of business records: possible phishing that references real project or invoice details, attempts to impersonate the company or its partners, and the longer-term possibility that contact or financial data could be reused in fraud. Because the scale and exact contents are unknown, it is not possible to quantify how many people face elevated risk. For the organisation itself, a ransomware claim can disrupt operations, damage commercial relationships and create regulatory or contractual notification obligations, depending on the jurisdictions involved and the nature of any personal data that may have been present. None of these outcomes is guaranteed by a leak-site listing alone; they depend on whether the claim is accurate and on what the files actually contained. The absence of confirmed numbers or data categories means the impact remains potential rather than measured.

What to do if you're exposed

If you have done business with uniaomarmores, worked for the company, or otherwise supplied personal or commercial information to it, treat the listing as a prompt for ordinary hygiene rather than confirmed compromise. Monitor bank and credit-card statements for unexpected activity, enable multi-factor authentication on email and financial accounts, and be sceptical of any unsolicited messages that reference marble orders, invoices or project details. Change passwords that may have been reused across services. If you receive a notification directly from the company, follow the instructions it provides. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets; such a scan does not prove or disprove involvement in this specific incident, but it offers a practical starting point for personal risk assessment. Public detail on this event remains limited, so continued caution and official updates from the organisation itself are the most reliable guides.

AICompiled with AI assistance from public sources and published under our editorial standards.