Babuk2 ransomware group lists modiin-ezrachi.co.il on its leak site

• Ransomware group: Babuk2
• Country: Israel
• Sector: Professional Services
• Announcement date: March 29, 2025

The ransomware group known as Babuk2 has announced a significant data breach involving the Israel-based security firm modiin-ezrachi.co.il. According to an announcement made on a leak site on March 29, 2025, the threat actor claims to have exfiltrated a massive volume of sensitive information belonging to the organization.

Details of the alleged breach

The threat actor known as Babuk2 claims to have published data belonging to modiin-ezrachi.co.il on their dedicated leak site. The group states that the alleged data package is 486 GB in size. The leak is claimed to contain various operational and personal records belonging to the organization. While the group has made these claims, information about this group remains limited in the public domain.

The timing of the alleged attack, as claimed by the group, dates back to October 12, 2024. Ransomware attacks often follow a pattern of double extortion, where threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage for ransom demands. By threatening to release stolen information on public leak sites, attackers aim to maximize pressure on the victim organization to pay the ransom.

The scope of the claimed data leak

According to the claims made by the threat actor, the stolen data includes a wide variety of highly sensitive documents and personal information. The breadth of the alleged leak suggests a deep penetration into the organization's internal records. The following types of data are reportedly included in the leak:

• Employee data
• Financial documents
• Passport scans
• Personal IDs
• Firearm licenses
• Vehicle licenses
• Military documents
• Medical records
• Insurance documents

The presence of such diverse data types—ranging from identity documents like passports and IDs to highly sensitive military and firearm licenses—indicates that the alleged breach covers multiple facets of the organization's operations and the private lives of its stakeholders.

About the target organization

Modiin Ezrachi is an Israel-based private investigation, security, and intelligence firm. The company operates in the fields of corporate security, risk management, and private investigation services. Given the nature of its business, the firm handles highly sensitive information related to security and intelligence operations.

Risks and implications of the leak

The nature of the allegedly leaked data may pose secondary risks such as identity theft and targeted phishing attacks for the organization's employees and clients. Because the stolen information includes personal identifiers, financial records, and medical documents, individuals affected by the breach may face prolonged risks of fraud and social engineering.

Furthermore, given the company's operation in the security sector, the sensitivity of the leaked information could create significant risks regarding supply chain security. Organizations that rely on security and intelligence firms for their own protection may find their own security posture compromised if the provider's data is exposed. The public disclosure of this data could lead to reputational damage and raise concerns regarding the organization's operational security.

From a regulatory perspective, the organization may face legal consequences under Israeli data protection regulations. When organizations deal with sensitive personal, medical, and military-related data, they are often subject to strict compliance requirements regarding how that data is stored and protected. In the wake of such incidents, organizations typically focus on incident response, forensic investigations to confirm the extent of the breach, and implementing enhanced security controls to prevent future unauthorized access.