carc.gov.jo Listed by funksec Ransomware Group

On January 9, 2025, the Jordanian Civil Aviation Regulatory Commission website carc.gov.jo appeared on the leak site of the funksec ransomware group, with attackers claiming to have exfiltrated internal files during a ransomware incident.

What's Publicly Reported from Reporting

Public reporting indicates that funksec listed the CARC domain and stated that internal files had been taken. The exact number of people whose information may have been exposed remains unknown. Available reporting describes the data as internal files rather than a specific list of stolen record types such as names, passports or financial details. No confirmed timeline of when the initial breach occurred has been published, and the Commission has not issued a detailed public statement on the volume or sensitivity of the material.

carc.gov.jo serves as the official online presence of Jordan’s Civil Aviation Regulatory Commission, the government body overseeing aviation safety, air navigation standards, airport operations and regulatory enforcement across the country.

Why This Matters for You and Your Family

When a government aviation regulator’s internal files are taken, the ripple effects can reach ordinary citizens. Travel records, licensing information, employee details or contractor data may be inside those files. If your name, passport number, address, email or phone number appears in any of those documents, the information can be sold or published. That puts you and your family at higher risk of identity theft, phishing campaigns and unwanted contact. Even if you have never flown in Jordan, shared family travel documents or applied for permits through government channels can link back to the same systems.

Credential leaks like this one often spread far beyond the original victim organization. Passwords or email addresses reused across personal accounts become entry points for criminals to target online banking, social media, email and shopping sites that you and your children actually use every day.

The Doxxing and Identity-Chain Implications

Once internal files leave an organization’s control, attackers can combine them with data from earlier breaches to build detailed profiles. A single email or phone number found in the CARC material can be chained to gaming usernames, social-media handles, family addresses and children’s accounts. This process turns isolated records into a map that reveals where you live, who you know and which services your household relies on. Gaming accounts belonging to teenagers are especially vulnerable because kids often reuse the same email or password they use for school or family sign-ups. The result is a doxxing chain that can lead to harassment, account takeovers or physical safety concerns.

Funksec Group’s Known Track Record

Public reporting attributes the attack to the funksec ransomware group. The group emerged in recent years and has targeted organizations across multiple sectors by deploying ransomware, exfiltrating data and then publishing samples on their leak site when victims do not pay. Their typical playbook involves gaining initial access, encrypting systems, stealing files and issuing extortion demands with deadlines. Past victims listed on their site include entities from different countries and industries, though specific prior high-profile cases remain limited in open sources. Readers can follow independent trackers for updated activity tied to the exact name funksec.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles and real-world identity so you can see exactly what chains back to the CARC breach.
• Rotate any password you used at carc.gov.jo or any Jordanian government site and enable two-factor authentication through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing your family is caught in hours rather than months.
• Cover the household with DoxxScan family protection that includes dependents and your children’s gaming accounts, which frequently become targets when credential leaks cascade into takeovers and doxxing chains.
• Let remediation specialists handle takedown requests and broker removals for you instead of trying to chase every site yourself.

The CARC listing is a reminder that government systems holding everyday travel and licensing data remain attractive targets. Taking concrete steps now limits how far leaked information can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to understand your exposure and begin closing the gaps.