Babuk2 ransomware group lists elsoms.com on its leak site

• Ransomware group: Babuk2
• Country: United Kingdom
• Sector: Agriculture and Food Production
• Announcement date: March 29, 2025

Babuk2 claims data exfiltration from elsoms.com

The Babuk2 ransomware group has published a leak announcement targeting elsoms.com, claiming to have successfully exfiltrated a significant amount of data. According to the announcement posted on the group's leak site on March 29, 2025, the threat actor alleges they have obtained approximately 500 GB of data. This alleged breach involves a variety of operational and personal records belonging to the organization. While the group has made these claims, public information regarding the specific identity and technical capabilities of the Babuk2 group remains limited.

The claim suggests that the breach may have occurred as early as September 7, 2024. Ransomware groups often use leak sites to host announcements regarding their targets, frequently employing a method known as double extortion. In a double extortion scheme, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data and threaten to publish it on public forums if a ransom is not paid. This tactic is designed to exert maximum pressure on the victim by threatening their reputation, legal standing, and competitive advantage.

Details of the alleged data breach

The information allegedly stolen by the Babuk2 group is extensive and covers multiple facets of the organization's operations. The threat actor claims that the compromised data includes a wide range of sensitive documents and personal identifiers. The nature of this data suggests a significant breach of both corporate and individual privacy.

The specific types of data mentioned in the claim include:

• Employee data
• Client information
• Payment documents
• Personal identity data
• Commercial proposals
• Financial documents
• Contracts

Beyond these categories, the claim specifies that the stolen information may contain scanned documents such as passports and driver's licenses, as well as dates of birth, company audit results, certifications, and product analysis results. The inclusion of such high-value personal and commercial information highlights the potential impact of the alleged theft.

About Elsoms Seeds

Elsoms Seeds is a leading independent seed breeding and seed supply company based in the United Kingdom. The organization specializes in the development, production, and marketing of vegetable and agricultural seeds for the farming industry. As a key player in the agricultural sector, the company's operations involve complex supply chains and significant amounts of proprietary research and commercial data.

Potential implications and organizational risks

The alleged compromise of such a diverse dataset presents several critical risks to the organization. The presence of personal identity data, such as passport and driver's license scans, poses secondary risks to both employees and clients, including the potential for identity theft and highly targeted phishing attacks. When attackers possess specific personal details, they can craft more convincing social engineering campaigns to further exploit individuals within the organization's network.

Furthermore, because the organization is based in the United Kingdom, this incident may fall under the scope of the UK GDPR. This regulatory framework governs how personal data must be protected, and a breach of this nature could lead to intense regulatory scrutiny and potential legal consequences. The loss of commercial proposals, contracts, and internal financial documents may also weaken the organization's competitive position in the market and disrupt its day-to-day operational processes.

In response to such incidents, organizations typically face the obligation to fulfill data breach notification requirements, which involves informing the relevant regulatory authorities and the individuals whose data has been affected. To defend against such threats, organizations in the agriculture and food production sector often implement defensive measures such as robust network segmentation, multi-factor authentication, and comprehensive data encryption to mitigate the impact of unauthorized access and exfiltration.