Babuk2 ransomware group lists icvc.co - Instituto Cardiovascular del Cesar on its leak site

• Ransomware group: Babuk2
• Country: Colombia
• Sector: Healthcare
• Announcement date: March 29, 2025

Babuk2 claims data breach at Instituto Cardiovascular del Cesar

The Babuk2 ransomware group has announced a significant data breach involving the Instituto Cardiovascular del Cesar. According to a post made on a leak site on March 29, 2025, the threat actor group claims to have exfiltrated a substantial amount of sensitive information belonging to the Colombian healthcare institution. The group alleges that the breach occurred on the same day the announcement was made, March 29, 2025.

This incident follows a common pattern seen in modern cyberattacks known as double extortion. In these scenarios, ransomware groups do not merely encrypt an organization's local files to disrupt operations; they also focus on stealing sensitive data before the encryption phase. The threat actors then use the threat of leaking this stolen information on public or dark web leak sites to pressure the victim into paying a ransom. While the specific ransom demand for this incident has not been disclosed, the claim of a massive data leak is a hallmark of this extortion tactic.

Details of the alleged data exfiltration

The Babuk2 group claims to have gained unauthorized access to the internal systems of the Instituto Cardiovascular del Cesar. According to the group's announcement, they have successfully exfiltrated approximately 272 GB of data. This stolen information is said to encompass a wide range of the organization's operational and medical processes, potentially exposing highly sensitive information to the public domain.

The data allegedly stolen by the group is diverse and includes various types of sensitive personal and institutional information. The listing claims the following data types were compromised:

• Employee information
• Patient records
• Scanned payment documents
• Driver's license scans
• Passport scans
• Financial documents
• Medical forms
• Pharmaceutical research documents
• Agreements and certifications

Publicly available information regarding the specific tactics, techniques, and procedures of the Babuk2 group remains limited, making it difficult to determine the exact method used to penetrate the healthcare institution's network.

About Instituto Cardiovascular del Cesar

The Instituto Cardiovascular del Cesar is a medical institution located in Valledupar, Colombia. The facility specializes in the diagnosis and treatment of cardiovascular diseases. It serves the local region by providing high-tech medical services to its patients, making the security of its digital infrastructure vital for patient care and institutional integrity.

Potential risks and organizational implications

The alleged leak of such a vast amount of data poses significant risks to patient privacy and the protection of sensitive personal information. For a healthcare provider, the exposure of medical forms and patient records is particularly critical. Such a breach could lead to severe consequences for the individuals involved, including increased vulnerability to identity theft and highly targeted phishing attacks. Furthermore, the claim that pharmaceutical research documents were stolen introduces secondary risks regarding the organization's intellectual property rights.

From a regulatory perspective, this incident could lead to administrative sanctions under the data protection regulations established in Colombia. When healthcare organizations face such breaches, it is often recommended that they initiate an urgent and thorough investigation to ensure the security of their patients and employees. General defensive measures for organizations in this sector typically include implementing multi-factor authentication, maintaining robust offline backups, and conducting regular security audits to detect unauthorized access before data exfiltration can occur.