2sign.co.il Listed by FunkSec Ransomware Group

On December 24, 2024, the Israeli digital signage company 2sign.co.il appeared on the leak site of the funksec ransomware group, with attackers claiming to have exfiltrated internal files during a ransomware incident.

What Public Reporting Shows

Public reporting indicates that funksec listed 2sign.co.il on its dark web leak page, presenting samples of allegedly stolen corporate data. The exact number of people whose information may have been exposed remains unknown, as does the full scope of the files taken. Available reporting describes the incident as a classic ransomware attack that combined encryption of systems with data theft for extortion.

Internal files were the primary material exfiltrated. No customer database size or specific record count has been publicly confirmed. The leak site posting itself serves as the main evidence of the breach.

Why This Matters for You and Your Family

When a company that handles business contracts, supplier lists, or client communications is breached, the ripple effects often reach ordinary people. If you or your family have interacted with 2sign.co.il — whether as a retail store owner, school administrator, restaurant manager, or event organizer — your name, email, phone number, or address may sit inside the stolen files.

Once that information leaves the company’s control, it can be sold, traded, or used to launch further attacks against you personally. Ransomware operators rarely limit themselves to corporate targets; they follow the data wherever it leads. For many families this means unexpected spam, phishing calls, or targeted scams that feel far more personal than generic junk mail.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently contain spreadsheets that link names to phone numbers, email addresses, physical locations, and sometimes notes about projects or personal preferences. Attackers and data brokers can combine these fragments with information from other breaches to build a complete profile.

Credential leaks like this one cascade into account takeovers when the same email and password appear in multiple places. A compromised business contact file can expose not only adults but also household connections, including children whose names appear on family accounts or school-related signage orders. The result is an expanding chain that can lead to doxxing, harassment, or identity theft.

Funksec Group Track Record

Public reporting attributes the funksec ransomware group with emerging in 2024. The group has claimed responsibility for attacks on organizations across multiple countries, typically listing victims on its dedicated leak site when ransom demands go unpaid. Its publicly known playbook involves initial access through common vectors such as phishing or exploited remote desktop services, followed by claimed exfiltration of sensitive files before deploying ransomware encryption. Extortion then proceeds in two stages: first demanding payment to prevent publication, then threatening to release the data on the clear web or dark web portals if the deadline passes.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used at 2sign.co.il or related business accounts, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same addresses or parent emails exposed in business files.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own logins.

The speed with which ransomware groups move stolen data means ordinary families must act quickly and systematically. Starting with a DoxxScan gives you both an immediate map of your exposure and ongoing protection through its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and family coverage that includes children’s gaming accounts. Taking these steps now limits how far this claimed breach can reach into your life.