Babuk2 ransomware group lists inmarsat.com on its leak site

• Ransomware group: Babuk2
• Country: United Kingdom
• Sector: Technology
• Announcement date: March 22, 2025

Babuk2 claims to have leaked Inmarsat data

The Babuk2 ransomware group has claimed responsibility for a data breach involving inmarsat.com. According to an announcement posted on the group's leak site on March 22, 2025, the threat actors assert they have successfully compromised the organization's systems and exfiltrated a significant amount of information.

The group's post alleges that the breach resulted in the theft of approximately 68 GB of data. In addition to the claim of data exfiltration, the group has reportedly shared credentials that were allegedly used to gain unauthorized access to the company's internal systems. This type of activity is characteristic of modern ransomware operations, where attackers often employ double extortion tactics. In such scenarios, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage, threatening to publish it on public leak sites if a ransom is not paid.

Details of the alleged data leak

The information disclosed by the Babuk2 group is said to include various types of sensitive corporate assets. The specific contents of the leak, as claimed by the attackers, consist of the following:

• Software products
• License information
• SSH keys
• PDF documents

The inclusion of highly sensitive technical assets such as SSH keys and licensing information is particularly concerning for the security posture of an organization. Such data can be utilized by malicious actors to facilitate secondary attacks or to attempt unauthorized access to critical infrastructure components.

About Inmarsat

Inmarsat is a British-based telecommunications company that provides global mobile satellite communication services. The organization offers critical connectivity solutions for several vital sectors, including the maritime, aviation, and government industries.

Security implications and assessment

This alleged breach may pose significant risks to the organization's operational security and its intellectual property. The disclosure of technical credentials, such as SSH keys, and sensitive license information could provide a roadmap for further unauthorized access attempts or secondary attacks against the company's infrastructure. Because Inmarsat is based in the United Kingdom, this incident may trigger specific data protection obligations under the UK GDPR, depending on the nature of the compromised data.

While information regarding the specific capabilities and history of the Babuk2 group remains limited, the nature of this claim highlights the ongoing risks faced by large-scale telecommunications providers. When organizations face such incidents, common defensive and remedial steps often include the immediate invalidation of all exposed keys and credentials to prevent further unauthorized access. Furthermore, a comprehensive security audit is typically required to identify the initial entry point and ensure that no persistent backdoors remain within the environment. Organizations in the technology and telecommunications sectors are encouraged to maintain rigorous access controls and continuous monitoring to mitigate the impact of potential credential exposure.