Babuk2 claims to have leaked Belarus e-commerce and energy sector data

• Ransomware group: Babuk2
• Country: Belarus
• Sector: Technology
• Announcement date: March 15, 2025

Babuk2 claims a major data breach in Belarus

The threat actor known as Babuk2 has announced a significant data leak on its dedicated leak site. The group claims to have exfiltrated and published a substantial dataset allegedly belonging to various organizations operating within the e-commerce and energy sectors in Belarus. According to the announcement made on March 15, 2025, the group asserts that they have made a massive collection of files available to the public.

Ransomware groups often utilize leak sites as a tool for double extortion. In this common cyberattack methodology, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information. The goal is to pressure the victim into paying a ransom by threatening to release the stolen data publicly, which can lead to severe reputational damage, regulatory fines, and loss of intellectual property.

Details of the claimed data leak

The Babuk2 group claims that the dataset consists of 85,947 files, totaling approximately 114 GB in size. The announcement specifically mentions several company names, including G-Energy, Auto-Energy, and Sivanabel, as being part of the affected entities. This breach targets critical infrastructure and commercial operations within the Belarusian technology and energy landscape.

The content of the allegedly leaked data is diverse and includes highly sensitive information. The group claims to have released the following types of data:

• Sensitive documents and contracts
• Sales records
• Bank transfer details
• Invoices
• 3D models and technical designs
• Customer transaction data

The exposure of such varied information—ranging from financial records to technical engineering assets—highlights the broad impact that a single breach can have on an organization's entire operational framework.

The impact of the exposure

The potential consequences of this leak are multifaceted. For the customers and employees of the affected companies, the exposure of transaction data and bank details significantly increases the risk of identity theft and financial fraud. When personal and financial information enters the public domain, individuals become prime targets for secondary attacks.

Furthermore, the inclusion of 3D models and technical designs poses a specific threat to the energy sector. The exposure of these technical assets could harm the competitive advantage of the firms involved and potentially weaken the security of the broader supply chain. Additionally, the organizations involved may face legal sanctions under Belarusian data protection regulations due to the exposure of sensitive information.

Risk assessment and defensive recommendations

Information regarding the Babuk2 group remains limited, but their method of directly publishing stolen data can trigger secondary extortion risks and targeted phishing attacks. When data is leaked publicly, attackers often use the stolen information to craft highly convincing social engineering campaigns, targeting specific employees or customers to gain further access or money.

To mitigate the impact of such incidents, it is highly recommended that the affected organizations initiate an urgent digital forensic investigation. Such an investigation is essential to determine the true scope of the leaked data and to identify the exact point of entry used by the threat actor. Organizations should focus on hardening their perimeter, implementing multi-factor authentication, and ensuring that all technical designs and sensitive contracts are stored in encrypted environments with strict access controls. Continuous monitoring and a robust incident response plan are critical components for any organization looking to defend against the evolving tactics of ransomware groups like Babuk2.