sincorpe.org.br Listed by FunkSec Ransomware Group

SINCOR-PE, the Insurance Brokers' Union of Pernambuco in Brazil, was listed on the leak site of the funksec ransomware group on December 09, 2024. The organization, which supports insurance brokers with resources, training, and advocacy, is claimed to have had internal files exfiltrated during a ransomware attack. Anyone whose personal or professional information is held by the union — members, staff, or business partners — may now face heightened risk of identity exposure.

Primary Disclosure Details

The funksec leak site listing states that SINCOR-PE suffered a ransomware attack in which internal files were exfiltrated. The disclosure does not quantify the number of affected records, specify exact data types beyond internal files, or list sample contents. It also does not disclose the ransom demand or any communication between the group and the victim. The entry simply states the data was obtained and is now hosted on the group's onion site for public viewing or further extortion pressure.

Why This Matters for You and Your Family

When a professional association like SINCOR-PE is breached, the information it holds often includes names, contact details, national identification numbers, banking information for dues, and correspondence tied to insurance brokers and their clients. Even if you are not a broker yourself, family members or household contacts may appear in membership records, training rosters, or vendor files. Once that data leaves controlled systems, it can be sold, traded, or used to launch targeted attacks against you at home. The disclosure indicates the files are now in the hands of a group that routinely pressures victims by threatening to publish or sell the material.

Doxxing and Identity-Chain Risks

Internal files from an industry union frequently contain enough overlapping details — email addresses, phone numbers, physical addresses, and professional license numbers — to link disparate online handles back to real people. Threat actors routinely chain these records with credential leaks from other breaches, creating detailed profiles that enable account takeovers, spear-phishing, and full doxxing. Because many insurance professionals reuse work passwords for personal services, a single exposure can cascade into gaming accounts, social media, or family email. Children’s accounts tied to the same household address are especially vulnerable once the primary identity chain is established.

Funksec Group Track Record

Public reporting attributes funksec with emerging in 2024 as a ransomware and extortion operation. The group typically gains initial access through phishing or exploited remote services, exfiltrates data before deploying encryption, and then uses dual extortion: threatening both data publication and operational disruption. Notable prior victims include smaller organizations and regional associations where internal documents can be leveraged for maximum embarrassment or regulatory pressure. The group’s playbook relies on public leak sites to amplify pressure when victims refuse payment, a pattern consistent with the December 09, 2024 listing of SINCOR-PE.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including cleanup of exposed records.
• Rotate any password used for SINCOR-PE systems or related professional portals anywhere it has been reused, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to credential chaining from this claimed breach.
• Let remediation specialists handle data-broker takedown requests and follow-up monitoring tied to the leaked internal files.

The SINCOR-PE breach underscores how even professional associations become gateways to personal exposure when ransomware groups treat stolen files as public leverage. Acting quickly on the credentials and identity chains created by this incident limits what attackers can build from it. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from cascading credential leaks.