Babuk2 claims data leak involving Venezuelan government portal www.gob.ve

• Ransomware group: Babuk2
• Country: Venezuela
• Sector: Government & Defense
• Announcement date: March 19, 2025

Babuk2 claims a significant data breach against www.gob.ve

The Babuk2 ransomware group has announced a data leak involving the official Venezuelan government portal, www.gob.ve. According to the announcement made on March 19, 2025, the threat actor group claims to have successfully gained access to data belonging to the organization. This claim was posted on a leak site, marking a potential significant security incident for the targeted government entity.

The group asserts that the breach occurred on March 19, 2025, the same day the announcement was published. While the specific methods used to infiltrate the network remain undisclosed, the group claims to have exfiltrated approximately 160 GB of data from the organization's systems. This volume of data suggests a substantial breach of the target's digital infrastructure.

Details of the claimed data exfiltration

The announcement specifies that the compromised information is highly sensitive, particularly concerning the organization's employees. The threat actor group claims that the leaked datasets include various forms of personally identifiable information and financial records. To support their claims, the group provided a screenshot that includes a document sample containing some of the organization's bank account details.

According to the group's claims, the following types of data have been compromised:

• Employee names
• Employee IDs
• Bank account information

The inclusion of financial information, such as bank account numbers, increases the severity of the claimed leak, as these details are often used in various fraudulent activities.

The targeted organization

The target of this claimed attack is www.gob.ve, which serves as the official web portal of the Venezuelan government. This platform is a critical piece of digital infrastructure, serving as the primary portal for accessing public services and providing information regarding state activities within the country. Given its role as a central hub for government information and services, the portal is a high-value target for cybercriminal groups.

Analysis and potential implications

This claim suggests that employees of the organization may face significant secondary risks resulting from the leak. Specifically, the exposure of names, identification numbers, and bank details can lead to identity theft and various forms of financial fraud. Furthermore, the leak of financial data could potentially impact the organization's own financial security and its internal operational processes.

While public information regarding the Babuk2 group is limited, their methods suggest they may employ double-extortion tactics in similar attacks. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data but also steal sensitive information, threatening to leak it publicly unless a ransom is paid. This tactic places immense pressure on organizations by threatening their reputation and compliance standing.

In such scenarios, organizations typically need to fulfill necessary notifications under relevant data protection regulations to inform affected individuals and authorities. To prevent the misuse of leaked data and to bolster their defenses against future incidents, organizations in the government and defense sector often find it necessary to enhance their security measures and monitoring capabilities.