babuk2 ransomware group lists heras.co.uk on its leak site

• Ransomware group: babuk2
• Country: United Kingdom
• Sector: Manufacturing
• Announcement date: March 26, 2025

Babuk2 claims to have breached Heras systems

The threat actor known as babuk2 has announced a significant data breach involving the British manufacturing company Heras. According to a post published on the group's leak site on March 26, 2025, the attackers claim to have successfully breached the systems of heras.co.uk. The group asserts that they were able to exfiltrate a substantial amount of corporate information, specifically claiming to have stolen 830 GB of data. While the group has made these claims publicly, information regarding the specific identity and background of the babuk2 group remains limited.

The timeline provided by the threat actor suggests the alleged attack occurred on May 29, 2024, several months prior to the public announcement on their leak site. This delay between the claimed intrusion and the public disclosure is a common occurrence in ransomware-related incidents, where attackers may hold data for a period before making demands or leaking information to exert pressure on the victim organization.

Details of the alleged data exfiltration

The claims made by babuk2 regarding the stolen information suggest a wide-ranging breach of sensitive corporate and personal documentation. The threat actor alleges that the exfiltrated data contains various types of highly sensitive information that could impact multiple stakeholders within the organization. The contents of the stolen data, as claimed by the group, include:

• Financial personal data
• Customer development schemes
• NDAs
• GDPR-related data
• Salary information
• External private audit reports

The variety of the data types mentioned suggests that the breach may have touched upon multiple departments, ranging from human resources and finance to legal and business development. In many modern ransomware attacks, threat actors employ a