Babuk2 ransomware group lists mohrss.gov.cn ( Ministry of Human Resources and Social Security ) on its leak site

• Ransomware group: Babuk2
• Country: China
• Sector: Government & Defense
• Announcement date: March 20, 2025

Babuk2 claims a massive data breach at China's Ministry of Human Resources and Social Security

The ransomware group known as Babuk2 has posted an announcement on its leak site claiming a successful compromise of the Ministry of Human Resources and Social Security of China (mohrss.gov.cn). According to the threat actor, the breach involved unauthorized access to the organization's internal servers, resulting in the exfiltration of a significant volume of sensitive information.

This claim follows a common pattern in modern cybercrime known as double extortion. In such scenarios, ransomware groups do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information beforehand. The threat actors then threaten to leak this data on public forums or dedicated leak sites if the victim fails to meet specific demands. This tactic places immense pressure on organizations, as the exposure of private data can lead to severe regulatory, legal, and reputational consequences that persist long after a system has been restored from backups.

Details of the alleged exfiltration

The announcement made by Babuk2 on March 20, 2025, alleges that the group managed to bypass security measures to access the internal server infrastructure of the ministry. The group claims to have stolen approximately 4 million records during the intrusion. To support their claims, the threat actor included a link in their post that provided access to samples of the allegedly stolen data, a common method used by ransomware groups to prove the validity of their breach to both the victim and the public.

While the specific details regarding the method of entry or the exact timing of the initial intrusion were not provided, the group's post explicitly identified the target as the primary government agency responsible for labor and social security in China. The alleged stolen data is highly sensitive, containing a wide array of personal and professional identifiers. According to the group, the compromised information includes:

• Name
• Mobile phone number
• ID number
• Gender
• Company information
• Date of birth
• City
• Address

The role of the Ministry of Human Resources and Social Security

The Ministry of Human Resources and Social Security of China is a critical government agency tasked with managing the country's labor market and social welfare systems. Its responsibilities include the implementation of employment policies and the oversight of the national social security network. Because the ministry is responsible for regulating the labor force and managing social security systems, it maintains vast databases containing the personal and professional details of a significant portion of the population.

Potential implications and defensive considerations

The claim that millions of citizens' personal data may be at risk has significant implications. If the data is verified, the exposure of such a large dataset could facilitate various forms of secondary cybercrime. Specifically, the combination of names, ID numbers, and contact details is highly valuable for identity theft, social engineering campaigns, and highly targeted phishing attacks. Furthermore, because the target is a government entity, such a breach could potentially impact national security and the overall integrity of public services.

For organizations operating within the government and defense sectors, protecting sensitive citizen data is a paramount security requirement. Defensive strategies typically involve implementing a multi-layered security approach. This includes robust identity and access management (IAM) to ensure only authorized personnel can access sensitive servers, and the use of multi-factor authentication (MFA) to mitigate the risk of compromised credentials. Additionally, organizations often employ continuous monitoring and endpoint detection and response (EDR) tools to identify unauthorized movements within a network. Regular security audits and the enforcement of strict data encryption protocols for data at rest and in transit are also essential components of a modern cybersecurity posture. Should such a breach be confirmed, organizations are generally required to follow specific regulatory procedures regarding data breach notifications to inform the affected individuals and relevant authorities.