Babuk2 claims to have stolen 1 TB of data from mazars.fr

• Ransomware group: Babuk2
• Country: France
• Sector: Financial Services
• Announcement date: March 10, 2025

Babuk2 lists mazars.fr on leak site

The Babuk2 ransomware group has officially listed the French organization mazars.fr on its dedicated leak site. According to the announcement made on March 10, 2025, the threat actor claims to have successfully exfiltrated a massive dataset belonging to the firm. The group asserts that they are in possession of approximately 1 TB of data, and they have indicated that the full dataset may be released to the public if no agreement is reached between the attackers and the organization.

Ransomware groups often utilize leak sites to pressure victims through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information to threaten its public release. This creates a secondary layer of pressure, as the victim faces not only operational downtime but also significant legal, regulatory, and reputational consequences resulting from the exposure of private data.

Details of the claimed data breach

The threat actor's announcement, which occurred on the same day as the claimed attack, suggests a significant breach of information. While the specific file count has not been disclosed, the volume of the data is estimated by the group to be 1 TB. The group claims that this dataset contains critical information, specifically highlighting the inclusion of financial records and email addresses belonging to the organization.

Based on the screenshots provided by the attackers, the leaked information is expected to include a variety of sensitive details. The data reportedly contains:

• Financial information and currency amounts
• Business names and country details
• Email addresses

The presence of such diverse data types suggests that the breach could impact various levels of the organization's operations, from administrative functions to client-facing financial services.

Mazars organization profile

Mazars is an international professional services firm that specializes in audit, tax, and advisory services. Operating in numerous countries worldwide, the company provides expertise in financial reporting and strategic consulting. As a major player in the professional services sector, the firm maintains a global footprint to support its diverse client base.

Potential impact and industry implications

This breach poses several significant risks to the organization, its employees, and its clients. The exposure of email addresses and business information can lead to targeted phishing attacks, where attackers use stolen details to craft highly convincing fraudulent communications. Furthermore, the theft of financial information increases the risk of identity theft for the individuals and entities involved.

Because Mazars is based in France, this incident may lead to complex compliance issues under the EU General Data Protection Regulation (GDPR). Organizations facing such incidents are often required to fulfill strict data breach notification requirements, ensuring that both regulatory authorities and the affected parties are informed within specific timeframes. Failure to comply with these regulations can result in substantial legal and financial penalties.

For a firm operating in the financial audit and consulting sector, the implications extend beyond legal compliance. The loss of data can lead to a significant erosion of client trust and a lasting damage to the organization's commercial reputation. In an industry built on accuracy and confidentiality, maintaining the integrity of client data is paramount.

To mitigate such risks, organizations in the financial sector typically focus on robust defensive measures. These include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data movement, and conducting regular security awareness training to prevent phishing. Additionally, maintaining a well-documented incident response plan is a critical component of organizational resilience when facing sophisticated ransomware groups like Babuk2, whose public information remains limited.