mandarin.com.br Listed by funksec Ransomware Group

On February 28, 2025, Brazilian technology provider mandarin.com.br appeared on the leak site of the funksec ransomware group. The company, which supplies email marketing, e-commerce platforms, and customer relationship management tools to individuals and businesses across Brazil, is claimed to have had internal files exfiltrated during a ransomware attack. While the exact number of people whose information may have been exposed remains unknown, anyone who interacted with Mandarin’s services — from small business owners to individual customers — may now face heightened risks of identity theft and doxxing.

Reported Details from Reporting

Public reporting indicates that funksec listed mandarin.com.br on its leak portal and claimed to have stolen internal company files. The breach stems from a ransomware incident in which the attackers gained access, exfiltrated data, and later published a sample on their public site at funksec.top/mandarin.com.br. No confirmed total of affected records has been released, and the precise types of personal information contained in the files have not been independently verified. Available reporting describes the exposed material as internal documents rather than a structured database of customer records, yet even limited leaks of this nature can contain names, contact details, contracts, or credentials that tie back to real individuals.

Why This Matters for You and Your Family

When a service provider like Mandarin suffers a breach, the ripple effects reach ordinary customers who entrusted the company with email addresses, phone numbers, or payment information. If your data was present in those internal files, criminals can use it to impersonate you, attempt account takeovers on other sites, or sell the details on underground forums. For families this often means children’s accounts become targets too, especially when shared family email addresses or phone numbers appear in the same leaked documents. Credential leaks like this one frequently cascade into gaming platform compromises, where a single reused password grants attackers access to your child’s Roblox, Fortnite, or Steam profile and the personal details stored there.

The Doxxing and Identity-Chain Risks

Once initial data surfaces, attackers rarely stop at the first leak. They combine the newly exposed information with records from earlier breaches to build detailed profiles. A phone number found in Mandarin’s files can be linked to usernames on social media, gaming platforms, or shopping sites. This identity-chain mapping lets criminals locate your home address, family members’ names, and even children’s online handles. The result is doxxing that can lead to harassment, targeted scams, or physical safety threats. Public reporting on similar incidents shows that what begins as a corporate ransomware leak often ends with personal exposure that affects every member of a household.

Funksec’s Publicly Known Track Record

Public reporting attributes the attack to the funksec ransomware group. The group emerged in late 2024 and has targeted organizations across multiple countries with a classic double-extortion playbook: they first encrypt victim systems, then exfiltrate sensitive files before threatening to publish the data unless a ransom is paid. Notable prior victims include other mid-sized technology and service firms. Their typical approach involves initial access through phishing or exploited vulnerabilities, followed by rapid data theft and publication on their leak site when negotiations fail. Exact success rates and total victims remain difficult to confirm, but available reporting describes funksec as an active and opportunistic player in the current ransomware landscape.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the Mandarin breach.
• Rotate any password you used at mandarin.com.br — and everywhere else it has been reused — then switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often share the same contact details exposed in corporate leaks.
• Let remediation specialists handle data-broker takedown requests and other cleanup steps while you focus on securing accounts and educating your family.

The incident at mandarin.com.br is a reminder that corporate breaches quickly become personal threats when identity chains are allowed to form. Acting quickly on exposed credentials and hidden linkages can prevent months of fallout. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control before the next wave of attackers connects the dots.