Babuk2 claims data breach against Iran gas service system
The Babuk2 ransomware group claims to have leaked 1.9TB of data belonging to the Iran gas service system.
- Published
- 1 min read
- 1 min read
- Ransomware group: Babuk2
- Country: Iran
- Sector: Energy & Utilities
- Announcement date: April 3, 2025
The Babuk2 ransomware group has announced a significant data breach targeting the Iran gas service system. According to an announcement made on a leak site, the threat actor claims to have exfiltrated a massive volume of sensitive information belonging to the organization.
Details of the claimed attack
On April 3, 2025, the Babuk2 group released an announcement claiming to have successfully conducted a cyberattack against the Iran gas service system. The group asserts that they have exfiltrated approximately 1.9TB of data from the organization's internal systems. This stolen information is reported to consist of various document information and access credentials.
To support their claims, the group has provided screenshots that appear to show the organization's internal management dashboard. These images provide a visual representation of the data they claim to have accessed, showing the interface used for managing the service system. Such tactics are common in modern ransomware operations, where groups use proof of access to pressure victims during extortion attempts.
Data types involved in the leak
The leaked information, as presented by the Babuk2 group, includes various types of sensitive data retrieved from the internal management dashboard. The screenshots provided by the attackers show that the following types of information are among the data affected:
- User names
- Registration numbers
- Mobile phone numbers
The presence of these specific data points suggests that the breach involves personal identifiable information (PII) related to the users of the gas service system.
The organization and the threat actor
The target of this alleged attack is the Iran gas service system, an entity operating within the Energy & Utilities sector in Iran. While the group has made these claims publicly, information regarding the specific identity and operational details of the Babuk2 group remains limited.
Ransomware attacks often follow a