Babuk2 claims data breach of India's telecommunication network

• Ransomware group: Babuk2
• Country: India
• Sector: Technology
• Announcement date: March 12, 2025

The Babuk2 ransomware group has announced a significant data breach involving India's telecommunication network. According to a post on a ransomware leak site dated March 12, 2025, the threat actor claims to have successfully exfiltrated a massive volume of sensitive information belonging to the telecommunications provider.

Details of the alleged attack

The announcement made by the Babuk2 group suggests that the data stolen from India's telecommunication network is now available for download. The group claims that the uncompressed size of the stolen dataset is approximately 1.8 TB. Furthermore, the threat actors assert that this data breach is not a localized incident but one that potentially impacts a massive scale of users, claiming the dataset contains information for around 750 million individuals.

Ransomware attacks of this nature often follow the model of double extortion. In such scenarios, threat actors do not merely encrypt an organization's systems to halt operations; they also steal sensitive data to use as leverage. By threatening to leak the stolen information on public or private leak sites, attackers aim to pressure the victim into paying a ransom to prevent the exposure of private information. This tactic increases the pressure on organizations, as the leak of customer data can lead to long-term reputational damage and legal consequences.

Scope of the stolen information

Based on screenshots provided by the group, the allegedly stolen data is highly sensitive and contains a wide variety of personal identifiers. The information claimed to be part of the leak includes a range of data points that could be used for various malicious purposes. The specific types of data identified in the claim include:

• Names
• Phone numbers
• Addresses
• National identification numbers (such as Aadhaar numbers)
• Photo ID numbers
• Family member information

The presence of such granular personal data, including national and photo identification numbers, significantly increases the risk profile of the breach. When attackers gain access to a combination of names, addresses, and government-issued IDs, it provides them with the necessary components to conduct sophisticated identity theft and targeted phishing campaigns against the affected individuals.

Potential impact and organizational implications

The scale of this alleged leak is immense. Given the volume of personal information mentioned, the breach could potentially affect a vast portion of the population in India. Such an event carries significant risks for the individuals involved, as the exposure of identity documents and family details can lead to secondary risks like identity theft and highly personalized social engineering attacks.

For the telecommunications sector, an incident of this magnitude can have profound consequences. Beyond the immediate operational disruptions often caused by ransomware, the exposure of such a large volume of customer data can impact an institution's operational integrity and its reputation for data security. Furthermore, depending on the local regulatory environment and data protection laws, a breach of this scale could lead to intense regulatory scrutiny and potential legal liabilities for the organization.

To defend against such threats, organizations in the technology and telecommunications sectors typically implement multi-layered security strategies. This includes robust encryption for data at rest and in transit, strict access controls to limit the movement of sensitive data, and continuous monitoring to detect unauthorized exfiltration. Additionally, maintaining comprehensive incident response plans and conducting regular security audits are essential steps for mitigating the impact of potential breaches. While information regarding the Babuk2 group remains limited in the public domain, the scale of this claim highlights the ongoing challenges faced by large-scale infrastructure providers in protecting vast amounts of citizen data.