Babuk2 ransomware group lists marinabaysands.com - Singapore Hotel (Internal Server) on its leak site

• Ransomware group: Babuk2
• Country: Singapore
• Sector: Hospitality
• Announcement date: March 12, 2025

Babuk2 claims to have exfiltrated data from Marina Bay Sands

The Babuk2 ransomware group has announced a significant data breach involving an internal server belonging to marinabaysands.com. According to the announcement made on a ransomware leak site on March 12, 2025, the threat actors claim to have successfully exfiltrated approximately 400 GB of data from the organization's systems.

The group asserts that they obtained this information from internal servers. To support their claim of unauthorized access to the organization's internal systems, the group has provided samples of user data as evidence. The threat actors have stated that they intend to release the allegedly stolen data publicly if the organization does not initiate contact for negotiations.

Details of the claimed data exfiltration

The data allegedly taken during this incident is described as being quite comprehensive, covering various aspects of user information. The information claimed to be part of the 400 GB exfiltration includes user identification details, contact information, personal profile data, and records regarding account activity.

Specifically, the listing identifies the following types of affected data:

• User identification details
• Email addresses
• Date of birth
• Gender
• Age
• Phone numbers
• Country information
• Account activity records

The nature of this information suggests a deep level of access to the internal databases used by the organization to manage its guest and user relations.

About Marina Bay Sands

Marina Bay Sands is a world-renowned integrated resort and hotel complex located in Singapore. It features a luxury hotel, a shopping mall, a museum, theaters, and a casino. As a major hub in the hospitality sector, the complex serves a vast number of international and local visitors.

Implications and security considerations

This incident may pose a significant risk to the privacy of the organization's users. The specific nature of the leaked data, which includes personally identifiable information (PII) and account activity, could increase the likelihood of affected individuals being subjected to identity theft or targeted phishing attacks. In such scenarios, attackers often use stolen contact information and personal details to craft highly convincing fraudulent communications to deceive victims.

For organizations operating within Singapore, such incidents may trigger legal obligations under the Personal Data Protection Act (PDPA). While public information regarding the Babuk2 group remains limited, the group appears to be employing double extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release, thereby increasing the pressure to pay the ransom.

In response to such threats, organizations typically need to review their data security processes and evaluate their incident response plans. This often involves notifying affected users and implementing enhanced monitoring to detect further unauthorized access. Strengthening defensive postures through regular security audits and robust data encryption can help mitigate the impact of such breaches.