Babuk2 ransomware group lists icmr.gov.in on its leak site

• Ransomware group: Babuk2
• Country: India
• Sector: Government & Defense
• Announcement date: March 17, 2025

The Babuk2 ransomware group has announced that it has successfully compromised data belonging to the Indian Council of Medical Research (ICMR). According to an announcement made on a leak site, the group claims to have targeted the icmr.gov.in domain, potentially exposing a massive amount of sensitive information.

The claimed attack and event details

On March 17, 2025, the Babuk2 group officially announced that it had conducted a cyberattack against the icmr.gov.in domain. In their statement, the group claims to have obtained personal data belonging to approximately 1.4 billion Indian citizens. To support these claims, the group has shared a portion of the alleged data as samples on their dedicated leak site.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also threaten to publish sensitive data on public forums if a ransom is not paid. This tactic is designed to exert maximum pressure on the victim by threatening their reputation and legal standing. While the group's specific methods and technical capabilities remain limited in terms of publicly available information, the scale of the claim is significant.

Alleged data types involved in the breach

The data allegedly leaked by the group is highly sensitive and covers a wide range of personal identifiers. According to the claims made by the attackers, the following information has been compromised:

• Name
• Father's name
• Phone number
• Passport number
• Aadhar number
• Age
• Gender
• Address
• District
• PIN code
• State
• City

The exposure of such a diverse set of identifiers—ranging from basic demographic details like age and gender to highly sensitive government-issued identifiers like Aadhar and passport numbers—presents a significant risk to the individuals involved. Such information is often the primary target for malicious actors looking to conduct identity theft or sophisticated fraud.

About the Indian Council of Medical Research

The Indian Council of Medical Research (ICMR) is one of the oldest and largest medical research bodies in India. It is responsible for the formulation, coordination, and promotion of biomedical research across the nation. Operating under the Ministry of Health, the ICMR serves as a primary authority on public health policies and medical standards, making it a critical institution for the country's healthcare infrastructure.

Implications and potential risks

If these claims are verified, this incident could represent a large-scale data breach with far-reaching consequences. The exposure of sensitive identification data belonging to Indian citizens may leave individuals vulnerable to identity theft and fraud. Furthermore, there is a risk that the leaked data could be utilized in secondary attacks or targeted phishing campaigns, where attackers use specific personal details to gain the trust of victims.

From a regulatory perspective, the institution could face legal and administrative sanctions under Indian data protection regulations due to the nature of the data involved. For organizations operating within the government and defense sectors, such incidents highlight the necessity of robust defensive measures. General defensive steps for organizations typically include implementing multi-factor authentication, maintaining rigorous patch management, and conducting regular security audits to identify vulnerabilities before they can be exploited by ransomware groups.

At this stage, a technical analysis of the group's claims remains necessary to clarify the actual scope and authenticity of the breach. The information regarding the specific ransom demand and the total size of the data exfiltrated remains unknown, as no such details were provided in the initial announcement.