babuk2 ransomware group lists iberdrola.com (Spain energy) on its leak site

• Ransomware group: babuk2
• Country: Spain
• Sector: Energy & Utilities
• Announcement date: March 24, 2025

Babuk2 claims theft of sensitive documents from Iberdrola

The threat actor known as babuk2 has listed the Spanish energy company iberdrola.com on its dedicated leak site. According to the announcement made on March 24, 2025, the group claims to have successfully targeted the organization and obtained a significant volume of data. This development follows a pattern often seen in modern cyberattacks, where threat actors use public leak sites to pressure victims into paying ransoms through a tactic known as double extortion. In such scenarios, attackers not only encrypt an organization's systems but also threaten to publish sensitive information to maximize their leverage.

The group has stated that they are currently in a negotiation phase with the target. The announcement indicates that the threat actors may proceed to release the stolen data if they do not receive a response from the organization. Currently, information regarding the specific methods, tools, or background of the babuk2 group remains limited, making it difficult to determine the full scope of their operational capabilities.

Details of the alleged data breach

The claims made by the babuk2 group suggest a substantial breach of information. The attackers assert that they have acquired approximately 2 TB of sensitive company documents. While the specific file types or the exact nature of the stolen files have not been detailed beyond the general description of sensitive documents, the sheer volume of the claimed data indicates a potentially widespread intrusion into the organization's digital environment.

The listing identifies the following as being affected by the alleged breach:

• Corporate documents

The presence of such a large amount of data on a leak site often serves as a psychological tool to increase the pressure on the victim. Even if the data is not immediately published, the mere claim of possessing such a volume of information can cause significant distress to the targeted entity.

About Iberdrola

Iberdrola is a multinational electric utility company headquartered in Spain. The organization maintains a significant global presence and operates extensively in several key areas of the energy market. Its core business activities include renewable energy, electricity generation, distribution, and retail services. Given its role in the energy and utilities sector, the company serves as a critical component of the infrastructure in its operating regions.

Potential impact and industry implications

The claims made by babuk2 pose several significant risks to the institution. If the allegations are accurate, the breach could impact the organization's operational continuity and its commercial reputation. The exposure of strategic information and the breach of corporate confidentiality could lead to long-term consequences for the company's market position and stakeholder trust.

Because Iberdrola is based in Spain, any confirmed breach involving personal or sensitive data would likely trigger obligations under the General Data Protection Regulation (GDPR). This could lead to scrutiny from regulatory bodies and potential sanctions. Furthermore, if the stolen data is eventually published, it may create secondary risks, such as targeted phishing attacks directed at third parties who may have been mentioned in the leaked documents.

For organizations operating in the energy and utilities sector, such incidents highlight the importance of robust defensive measures. Common industry practices to mitigate these risks include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized movement, and ensuring regular, offline backups of critical data. Additionally, maintaining a strong incident response plan and adhering to international data protection standards are essential steps for managing the fallout of potential cyber incidents.