mymobileforms app Listed by FunkSec Ransomware Group

On January 13, 2025, the funksec ransomware group listed the MyMobileForms platform on its leak site, claiming that internal files had been exfiltrated from the company during a ransomware attack. MyMobileForms provides an online service that lets organizations replace paper forms with mobile-friendly digital versions that can be completed on smartphones, tablets, or computers. Anyone whose organization used the platform, or whose personal information was entered into forms created through it, may now have data exposed.

What Public Reporting Shows

Public reporting indicates the incident involves a ransomware deployment that led to both encryption and data theft. The funksec leak site published evidence of the exfiltration on January 13, 2025. Available details describe the stolen material as internal files rather than a structured database of customer records. The exact number of individuals affected remains unknown because the published sample does not include a full list of exposed personal records.

The platform itself focuses on data collection through digital forms, which often contain names, addresses, contact details, signatures, and other sensitive business or personal information depending on how organizations configured their forms. No public timeline has been released detailing when initial access was gained or when the data was taken.

Why This Matters for You and Your Family

When a service that handles forms for schools, medical providers, employers, or community groups is breached, the information you or your children submitted can end up in attackers’ hands. Internal files exfiltrated may include spreadsheets, completed forms, or configuration data that link names, emails, phone numbers, and physical addresses. Once that information leaves the company’s control, it can be sold, published, or used to launch further attacks against you.

Ordinary families rarely realize their data passed through a third-party form platform. A youth sports registration, a summer camp health form, or a school permission slip created on MyMobileForms could contain your child’s date of birth, medical notes, or home address. When those records surface in a ransomware leak, the risk extends beyond the original organization to every person named inside the files.

The Doxxing and Identity-Chain Implications

Ransomware operators increasingly treat stolen files as raw material for doxxing campaigns. A single leaked form can supply an email address that links to a reused password, which then unlocks social-media accounts, gaming profiles, or cloud storage. These connections create an identity chain that reveals far more than the original breach suggested. Public reporting shows that credential leaks of this nature frequently cascade into account takeovers and targeted harassment.

Children’s gaming accounts are especially vulnerable because parents often reuse passwords or security questions that appear in family forms. A leaked address or parent email from a MyMobileForms record can give attackers the exact details needed to reset a child’s Roblox, Fortnite, or Discord account. Once they control the gaming profile, they can demand ransom, post private chats, or use the account as a pivot to other family devices.

Funksec’s Publicly Known Track Record

Public reporting attributes the funksec ransomware group with activity that emerged in 2024. The group has listed multiple organizations on its leak site, typically following a double-extortion model: it encrypts victim systems and threatens to publish stolen data unless a ransom is paid. Its playbook usually begins with phishing or exploitation of remote-access tools for initial access, followed by claimed exfiltration of internal documents before encryption. Notable prior victims include smaller businesses and service providers whose customer or operational files were later posted as leverage. Exact success rates and total victims are difficult to verify because the group, like many ransomware operations, selectively reports its wins.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this leak connects to.
• Rotate any password you used on the MyMobileForms platform or anywhere else it has been reused, then enable two-factor authentication through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and parent emails exposed in form data.
• Let remediation specialists handle takedown requests for any personal information already appearing on data-broker or leak sites while you focus on securing accounts.

The incident underscores that even routine digital forms can become gateways to larger privacy violations when the companies behind them suffer ransomware attacks. Taking concrete steps now limits how far the leaked data can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered handles to real identities, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting that process promptly gives you a practical way to interrupt the doxxing chains before they reach your family.