rscn.org.jo Listed by FunkSec Ransomware Group

The Royal Society for the Conservation of Nature in Jordan appeared on the funksec ransomware group’s leak site on December 04, 2024. The listing states that the non-profit organization suffered a ransomware attack in which internal files were exfiltrated. The disclosure does not specify the number of records affected or the exact types of documents taken, only that sensitive internal material is now in the attackers’ possession and available for public download on the dark-web portal.

Reported Details from the Listing

The funksec leak page explicitly names rscn.org.jo and describes the incident as a successful ransomware deployment followed by data exfiltration. No victim count is provided, and the listing does not itemize the files. The portal shows a sample of the stolen material and gives a countdown timer typical of extortion campaigns. Public mirrors of the leak site, tracked through ransomware.live, state the posting date as December 4 and show the organization remains listed without any indication that the data has been removed.

Why This Matters for You and Your Family

When a respected conservation organization in Jordan has its internal files stolen, anyone whose personal information passed through that organization faces real risk. If you have donated, volunteered, attended programs, or worked with RSCN, your name, contact details, or financial records may sit inside the exfiltrated material. Even though the disclosure does not quantify affected records, the nature of nonprofit operations means donor databases, employee files, and partner agreements are common targets. Once posted on a ransomware leak site, that information rarely stays private.

Internal files from such groups frequently contain scanned IDs, bank details for grants, correspondence that reveals home addresses, and email lists. Any of these can be combined with other publicly available data to build a profile that puts you and your family in the crosshairs of identity thieves or harassment campaigns.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at posting raw files. They often comb through stolen documents for email addresses, usernames, and phone numbers that link to personal accounts elsewhere. A single leaked work email from RSCN can reveal your username on other services, especially if you reused credentials. Those links create an identity chain: an attacker who finds your child’s gaming handle in a family membership record can pivot to gaming platforms, social media, and eventually physical addresses. Credential leaks like this one regularly cascade into account takeovers that expose children’s profiles and household information.

Funksec’s Publicly Known Track Record

Public reporting attributes the funksec group’s first notable activity to mid-2024. The gang has targeted organizations across multiple countries, focusing on mid-sized enterprises and nonprofits that possess valuable internal documentation. Typical playbook begins with initial access through phishing or exploited remote desktop services, followed by rapid exfiltration of documents before encryption. Extortion follows a double-pressure model: first demanding ransom from the victim, then publishing samples on their leak site with a public countdown if payment is not made. The group’s listings usually emphasize “internal files” rather than payment-card data, suggesting a focus on sensitive operational material that can be leveraged for embarrassment or further identity exploitation.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including any ties to rscn.org.jo that may now be exposed.
• Rotate any password you ever used at rscn.org.jo or related conservation platforms, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same leaked addresses or family emails.
• Let remediation specialists handle takedown requests and broker removals for any personal data that has already surfaced from this or connected incidents.

The incident underscores that even organizations dedicated to public good can become unwilling gateways to personal exposure. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to close the gaps this claimed breach has opened.