babuk2 ransomware group lists JD.com Inc (Chinese) on its leak site

• Ransomware group: babuk2
• Country: China
• Sector: Technology
• Announcement date: March 16, 2025

Babuk2 claims to have stolen data from JD.com Inc

The threat actor known as babuk2 has published an announcement on its leak site regarding the Chinese technology company JD.com Inc. According to the post, the group claims to have obtained a significant amount of information belonging to a massive user base. The announcement was made on March 16, 2025, and the group claims the attack occurred on the same date.

The group asserts that the stolen data belongs to 141 million users of JD.com Inc. The total size of the alleged data breach is reported to be 11.5 GB. While the group has provided contact information via email and encrypted messaging platforms to allow the organization to reach out, specific details regarding the group's identity and background remain limited. No ransom demand was specified in the announcement.

Details of the alleged data breach

The information allegedly obtained by the babuk2 group is said to be highly sensitive, potentially exposing a vast number of individuals to various cyber risks. The claim suggests that the stolen data includes a wide range of personal identifiers and account credentials. According to the group's post, the following types of data are included in the leak:

• Real names
• Usernames
• Passwords
• Email addresses
• QQ numbers
• Phone numbers
• ID card information

The presence of such diverse data types—ranging from contact details to official identification numbers—highlights the potential severity of the alleged incident. It is important to note that the accuracy and the actual scope of this data have not been independently verified.

About JD.com Inc

JD.com Inc is a leading Chinese e-commerce and technology company. Operating in retail, logistics, and artificial intelligence, it is one of the largest online retailers in China.

Potential risks and organizational implications

These allegations may pose a significant privacy risk to the organization's user base. There is a possibility that users could be exposed to identity theft and targeted phishing attacks. Furthermore, a secondary risk involves the potential for account takeover incidents; if the leaked passwords are reused on other platforms, those accounts may be compromised.

From a regulatory perspective, the organization may face legal processes under China's data protection regulations (PIPL). While the impact on the organization's reputation and operational security remains to be seen, such leaks often result in significant challenges for large-scale enterprises. Such incidents can damage consumer trust and necessitate extensive forensic investigations to determine the true extent of the exposure.

In the broader context of cybersecurity, ransomware groups often utilize a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to publish the stolen data on a leak site, the attackers aim to pressure the victim into paying a ransom to prevent the public disclosure of private information. This method increases the pressure on organizations to comply with demands to protect their reputation and avoid regulatory penalties.

To defend against such threats, organizations in the technology and e-commerce sectors typically implement various defensive layers. These include robust encryption for data at rest and in transit, multi-factor authentication (MFA) to mitigate the risk of password reuse, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Additionally, maintaining a comprehensive incident response plan and ensuring compliance with regional data protection laws are critical components of a modern cybersecurity posture.