thecitybank.com Listed by funksec Ransomware Group

On January 21, 2025, thecitybank.com appeared on the leak site of the funksec ransomware group. The Bangladesh-based commercial bank is claimed to have had internal files exfiltrated during a ransomware attack, with the threat actors now publicly listing the victim and threatening to publish the stolen data.

What's Publicly Reported from Reporting

Public reporting indicates that funksec claims to have obtained internal documents from City Bank, one of Bangladesh’s longest-operating private commercial banks. The bank provides retail banking, SME lending, credit cards, treasury services, and corporate banking to customers across the country. Available reporting describes the incident as a ransomware attack in which data was both encrypted and exfiltrated. The exact number of customers or employees whose information appears in the files remains unknown. No samples of the allegedly stolen data have been independently verified in open sources at the time of writing.

Why This Matters for You and Your Family

When a bank suffers a breach, the information at risk often includes personal details that criminals can use to target you directly. Internal files can contain customer names, addresses, account numbers, transaction records, contact information, and sometimes scanned identification documents. If your bank is City Bank or you have ever held an account there, your data could now sit on a ransomware leak site. Criminals routinely sell or weaponize such records to commit identity theft, open fraudulent accounts, or launch phishing campaigns tailored to banking customers. Your family members listed on joint accounts or as beneficiaries are also exposed.

The Doxxing and Identity-Chain Implications

A single breach rarely stops at the original victim. Criminals use leaked emails, phone numbers, and addresses to link your banking identity to usernames on social media, shopping sites, and gaming platforms. This creates an identity chain that can lead to doxxing, account takeovers, and harassment. Credential leaks like this one frequently cascade into gaming account compromises because children and teenagers often reuse the same email addresses or passwords they use for school or family banking apps. Once attackers control a gaming account tied to a real name and address, they can extract further personal details or demand ransom from the household.

Funksec Group’s Publicly Known Track Record

Public reporting attributes the attack to funksec, a ransomware group that emerged in late 2024. The group has claimed responsibility for attacks on organizations across multiple countries, typically targeting mid-sized companies and regional financial institutions. Their standard playbook involves gaining initial access through phishing or exploited remote desktop services, exfiltrating sensitive files before deploying ransomware, and then pressuring victims with a short extortion deadline followed by public listing on their leak site if payment is not made. Funksec’s prior victims have included healthcare providers, manufacturers, and other banks, according to trackers monitoring ransomware activity.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, usernames, and real-world identity so you can see exactly what the City Bank files may have exposed.
• Rotate any password you used at thecitybank.com or any related City Bank service, then enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak that touches your family is caught within hours instead of months.
• Cover the entire household with DoxxScan family protection, which includes children’s gaming accounts that often chain back to the same addresses and emails used for banking.
• Let remediation specialists handle data-broker takedown requests and follow-up on any exposed records so you do not have to chase them yourself.

The City Bank incident shows how quickly a regional bank breach can place ordinary families in the crosshairs of organized ransomware operators. Taking concrete steps now limits the damage and reduces the chance that this leak becomes the first link in a larger identity theft or doxxing campaign. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information.