babuk2 ransomware group lists ezbuy.sg (Singapore Shopping) on its leak site

• Ransomware group: babuk2
• Country: Singapore
• Sector: Retail & E-Commerce
• Announcement date: April 3, 2025

Retail platform ezbuy.sg targeted in data leak claim

The Singapore-based retail platform ezbuy.sg has been targeted in a data leak claim published by the threat actor known as babuk2. According to an announcement made on April 3, 2025, the group claims to have successfully compromised the organization and exfiltrated a significant volume of information.

Details of the claimed attack

The threat actor known as babuk2 claims to have compromised ezbuy.sg, alleging that they have stolen information belonging to approximately 2 million users. The group asserts that the breach involves a total of 68 GB of documents. This announcement, which was posted on the group's leak site on April 3, 2025, identifies the incident as a data leak. While the group has made these claims, it is important to note that information regarding this specific threat actor remains limited in the public domain.

Ransomware groups often utilize leak sites to pressure victims through a tactic known as double extortion. In such scenarios, attackers do not merely encrypt a company's systems to disrupt operations; they also steal sensitive data to threaten its public release. This creates a dual pressure point: the victim must deal with the operational downtime caused by encryption and the reputational and legal risks associated with a massive data exposure.

Claimed affected data

The announcement claims the leak contains information on 2 million users and 68 GB of customer invoices and various documents. The specific data types mentioned in the claim include:

• Customer information
• Customer invoices

The exposure of such documentation, particularly invoices, can be highly sensitive as it often contains transaction details and personal identifiers used to facilitate commerce.

About ezbuy.sg

ezbuy is a Singapore-based cross-border e-commerce platform that facilitates the import and delivery of products from China and other countries. It provides an intermediary service that allows users to shop from global marketplaces, acting as a bridge between international sellers and local consumers.

Risk assessment and industry implications

These claims may pose significant risks of identity theft and fraud for ezbuy.sg users. The exposure of customer financial data or invoice details could create a basis for targeted phishing attacks, where malicious actors use stolen information to craft highly convincing fraudulent communications to trick users into revealing even more sensitive credentials.

As an e-commerce platform operating in Singapore, the incident may lead to legal consequences under the Singapore Personal Data Protection Act (PDPA). Organizations operating in the retail and e-commerce sector face high stakes during such incidents due to the volume of personal and financial data they process. A review of the organization's data security processes and the notification of affected users may be necessary to mitigate potential secondary risks.

To defend against such threats, organizations in the e-commerce sector typically focus on robust data encryption, strict access controls, and comprehensive monitoring of data movement to detect unauthorized exfiltration. Furthermore, maintaining a clear incident response plan and ensuring compliance with regional data protection regulations are essential components of a modern cybersecurity posture. The potential for secondary risks, such as identity theft, underscores the importance of rapid communication with affected parties to help them secure their accounts and monitor for suspicious activity.