Babuk2 ransomware group lists moh.gov.rw on its leak site

• Ransomware group: Babuk2
• Country: Rwanda
• Sector: Government & Defense
• Announcement date: March 31, 2025

Babuk2 claims to have stolen data from the Rwandan Ministry of Health

The Babuk2 ransomware group has published an announcement on its leak site claiming to have obtained a significant amount of data belonging to the Ministry of Health of Rwanda (moh.gov.rw). According to the claim made by the threat actor, the breach occurred on March 31, 2025, and involves a substantial volume of information extracted from the institution's digital infrastructure.

Ransomware leak sites are frequently used by cybercriminal groups as a tool for double extortion. In this tactic, attackers not only encrypt an organization's files to disrupt operations but also steal sensitive data to threaten the victim with public disclosure. By publishing announcements on these sites, threat actors attempt to pressure organizations into paying ransoms to prevent the release of confidential information, which can lead to severe reputational and legal consequences.

Details of the alleged cyberattack

In the announcement published on March 31, 2025, the Babuk2 group alleges that they successfully gained unauthorized access to the systems belonging to moh.gov.rw. The group claims that approximately 52 GB of data was obtained directly from the institution's websites. To support their claims, the threat actors provided a download link for data samples within their announcement, allowing potential observers to verify the legitimacy of the stolen information.

While the specific contents of the 52 GB of data have not been fully detailed by the attackers, the group alleges that the stolen information is related to the institution's internal management systems. Specifically, the claim points toward data involving the following:

• Health workforce management system data

About the Rwandan Ministry of Health

The Ministry of Health of Rwanda is the government institution responsible for setting health policies, regulating healthcare services, and managing public health in the country. As a central authority in the nation's healthcare infrastructure, the ministry manages critical systems essential for the delivery and oversight of medical services across Rwanda.

Potential impact and organizational implications

This incident highlights the potential risks faced by public sector institutions and the extreme sensitivity of the data they manage. If the alleged data indeed includes personal information belonging to healthcare personnel, it could create significant opportunities for malicious actors to conduct identity theft or launch targeted phishing attacks against individuals within the health sector.

Furthermore, such breaches can have negative impacts on an institution's operational continuity. Disruptions in public services may occur if the integrity or availability of management systems is compromised. The incident may also trigger legal processes under Rwanda's data protection regulations, as the handling of sensitive personnel information is strictly governed by law.

For organizations within the government and public health sectors, maintaining robust defensive postures is critical. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security audits to identify vulnerabilities. Given that public information regarding the Babuk2 group remains limited, organizations must remain vigilant against evolving tactics used by such threat actors to compromise sensitive government data.