Babuk2 ransomware group lists movistar.com.pe on its leak site

• Ransomware group: Babuk2
• Country: Peru
• Sector: Technology
• Announcement date: March 14, 2025

Babuk2 claims massive data breach at Movistar Peru

The Babuk2 ransomware group has published an announcement on their leak site claiming to possess data belonging to approximately 21 million users of movistar.com.pe. This announcement, made on March 14, 2025, marks a significant escalation in the threat actor's activity against the telecommunications provider.

The threat actor known as Babuk2 published the announcement on March 14, 2025, claiming to have targeted movistar.com.pe. The group alleges that they have compromised data belonging to approximately 21 million users and has shared a portion of this data as a sample. The threat actor indicated that they would publish the remaining data if the organization does not establish contact. Information about this group is limited.

The tactics employed by the group appear to follow the pattern of double extortion. In such scenarios, threat actors do not merely encrypt an organization's systems to demand a ransom for decryption; they also exfiltrate sensitive data to use as leverage. By threatening to leak the stolen information publicly, the attackers attempt to exert maximum pressure on the organization to meet their demands.

Details of the alleged data theft

According to the shared data, the information includes several types of sensitive user information. The breach, as claimed by the attackers, involves a variety of personal and service-related details that could be highly sensitive for the affected individuals. The specific types of information identified in the leak include:

• Identification numbers (DNI)
• Customer type
• Mobile plan details
• Subscription status information

The scale of the allegedly compromised data may increase the risk of identity theft and targeted phishing attacks for the organization's users. The sensitivity of the alleged data could create negative impacts on the financial and personal security of the users.

About Movistar Peru

Movistar Peru is a leading telecommunications company operating in Peru as part of the Telefonica group. It provides mobile communication, landline, broadband internet, and television services. Given its role as a major provider of essential communication services, the organization maintains a vast database of customer information to manage its diverse service offerings.

Impact and organizational risks

The alleged breach carries significant consequences for both the organization and its customers. The organization may face administrative sanctions under data protection regulations in its operating region. Furthermore, the organization may experience reputational damage and disruptions to its operational processes due to the scale of the claimed theft.

For the users, the exposure of identification numbers and subscription details significantly elevates the risk of fraudulent activities. When personal identifiers are leaked, attackers often use them to craft highly convincing phishing campaigns or to attempt identity theft, which can have long-lasting financial and personal security implications for the victims.

In the telecommunications sector, such incidents highlight the critical importance of robust data protection frameworks. Organizations in this sector typically focus on implementing multi-layered security defenses to protect vast amounts of consumer data. This includes monitoring for unauthorized data exfiltration, implementing strict access controls, and maintaining rigorous encryption standards for data at rest and in transit. Furthermore, maintaining a rapid incident response plan is essential for managing the operational and reputational fallout that follows a major security event.