moph.gov.lb Listed by funksec Ransomware Group

On December 30, 2024, the Lebanese Ministry of Public Health had internal files listed for sale on the leak site operated by the funksec ransomware group. The data was taken during a ransomware attack on moph.gov.lb, the official domain used by the government body responsible for national health policy, hospital oversight, and public health programs across Lebanon. Anyone whose medical records, personal details, or family information passed through the ministry’s systems could be affected.

Reported Details of the Breach

Public reporting indicates that funksec extracted internal files from the Ministry of Public Health’s network. The exact number of people whose data was taken remains unknown. The compromised material consists of internal files rather than a simple database dump. No specific deadline for payment has been publicly detailed in available reporting, though ransomware groups routinely set short windows before full data publication.

Why This Matters for You and Your Family

When a government health ministry is breached, the information involved often includes names, addresses, national ID numbers, medical histories, insurance details, and contact information for patients, employees, and their families. If your family has used public hospitals, applied for health subsidies, or registered births, vaccinations, or chronic conditions in Lebanon, your records may now sit in an attacker’s hands. Medical data is especially sensitive because it can be used for identity theft, insurance fraud, blackmail, or targeted scams that feel deeply personal.

Ordinary families rarely think their routine health visits could end up on a dark web leak site, yet that is exactly what has happened here.

The Doxxing and Identity-Chain Risks

Health records frequently contain enough breadcrumbs to link an individual’s real identity to online handles, children’s names, school details, and even gaming accounts. Attackers piece these fragments together into an identity chain that lets them move from one compromised account to the next. A leaked ministry file that lists a parent’s email and child’s date of birth can quickly unlock social media profiles, then gaming logins, then further personal data. Once the chain starts, doxxing escalates fast.

Credential leaks like this one cascade into account takeovers and doxxing chains, which is why protecting both adult and children’s gaming accounts matters. A single exposed government record can give attackers the key to map an entire household’s digital footprint.

Funksec’s Publicly Known Track Record

Public reporting attributes the attack to the funksec ransomware group. The group emerged in 2024 and has targeted organizations across multiple sectors by gaining initial access, exfiltrating data, and then demanding payment to prevent publication. Their typical playbook follows the double-extortion model common in ransomware: encrypt systems where possible, steal sensitive files, and threaten to release them unless the victim pays. Notable prior victims have included various private companies and government-linked entities, though details remain limited in open sources.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, family names, and online handles that may have been exposed in the ministry breach.
• Rotate any password you used on moph.gov.lb or related Lebanese government portals and enable 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and acted on quickly.
• Cover the household with DoxxScan family coverage that includes dependents and your children’s gaming accounts, which often chain back to the same addresses and identities.
• Let remediation specialists handle the time-consuming work of sending takedown requests to data brokers and monitoring platforms where your information surfaces.

The funksec listing of Lebanese Ministry of Public Health files is a reminder that government health data breaches directly threaten ordinary families’ privacy and safety. Taking concrete steps now can limit the damage and reduce the chance that this incident becomes the start of a longer identity theft or doxxing campaign. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and family coverage that includes children’s gaming accounts.