babuk2 ransomware group lists bank.pingan.com (CN) on its leak site

• Ransomware group: babuk2
• Country: China
• Sector: Financial Services
• Announcement date: March 10, 2025

The ransomware group known as babuk2 has issued a data leak announcement on its leak site, claiming to have targeted bank.pingan.com. According to the threat actor, the group has successfully exfiltrated approximately 900 GB of data belonging to the institution. This announcement, posted on March 10, 2025, marks a significant claim of a data breach involving a major financial entity.

The details of the claimed attack

The threat actor known as babuk2 has published a formal data leak announcement on its dedicated site, specifically targeting bank.pingan.com. The group claims to be in possession of approximately 900 GB of data that is related to the institution's financial and insurance operations. This massive volume of data suggests a wide-reaching intrusion into the organization's digital infrastructure.

In accordance with common ransomware extortion patterns, the actor has issued a threat regarding the stolen information. The group states that it will proceed to publish the collected data if the institution does not initiate contact with them. This tactic is a hallmark of modern cyber extortion, where the threat of public exposure is used as leverage to force a payment.

Data and information involved in the leak

Based on the information provided by the threat actor, the stolen data is highly sensitive, specifically involving the institution's insurance and financial operations. Screenshots associated with the claim indicate that the leaked information includes detailed insurance policy information. This data is highly personal and could be used for malicious purposes if released publicly.

The specific types of data identified in the claim include:

• Insurance policy information
• Identification numbers
• Financial data

The presence of such sensitive information, including details such as policyholder names, identification numbers, dates of birth, and financial information regarding insurance coverage, highlights the potential impact of the breach.

About Ping An Bank

Ping An Bank is a large-scale financial institution based in China, providing retail and corporate banking services. It operates as a subsidiary of the Ping An Insurance group.

Impact and industry implications

This incident may increase the risk of identity theft and fraud for the institution's customers due to the nature of the alleged leaked data. Given the sensitivity of the information involved, the institution may face significant challenges regarding compliance with data protection regulations. The group may be employing double extortion tactics as part of its ransomware operations, a method where attackers not only encrypt data but also threaten to leak it to maximize pressure on the victim.

In such scenarios, organizations are often required to fulfill data breach notification obligations and inform the affected individuals to mitigate potential harm. For financial institutions, maintaining robust cybersecurity frameworks is essential to prevent such exfiltration. Common defensive steps for organizations include implementing strict access controls, monitoring for unauthorized data transfers, and ensuring comprehensive encryption of sensitive customer data both at rest and in transit.

Publicly available information regarding the babuk2 group remains limited, making it difficult to determine the full scope of their capabilities or long-term objectives. However, the scale of the claimed theft underscores the ongoing threat posed by ransomware groups to the global financial services sector.