babuk2 ransomware group lists nadra.gov.pk - NADRA official Of Pakistan Army & (Andhra Pradesh) on its leak site

• Ransomware group: babuk2
• Country: Pakistan
• Sector: Government & Defense
• Announcement date: March 27, 2025

Babuk2 claims to have leaked massive datasets from NADRA

The ransomware group known as babuk2 has announced a significant data breach targeting nadra.gov.pk. According to an announcement made on a leak site on March 27, 2025, the threat actors claim to have exfiltrated approximately 70 GB of data. This massive volume of information is alleged to contain roughly 450 million records, representing a substantial breach of sensitive information belonging to the National Database and Registration Authority (NADRA) of Pakistan.

Ransomware attacks often involve a tactic known as double extortion, where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to release this information on public leak sites, threat actors aim to pressure the victim into paying a ransom. In this instance, the group has already moved to the leak phase by publishing an announcement regarding the stolen data.

Details of the alleged breach and claimed data

The incident was officially announced by the babuk2 threat actor on March 27, 2025. The group claims to have successfully obtained data from units affiliated with the Pakistani government and the military. This claim adds a layer of complexity to the breach, as the group asserts that the stolen information includes data belonging to the Pakistan Army and other secret organizations.

Evidence provided by the group, including screenshots, suggests that the stolen information is diverse in nature. The leaked content appears to include tables containing various types of sensitive information, such as regional data and health-related records. Specifically, the group has displayed data that appears to be related to COVID-19 health records from Andhra Pradesh, including patient identification numbers. The specific items identified as being affected include:

• Patient health records
• Identification numbers
• Regional information

While the group's claims are significant, it is important to note that information regarding this specific threat actor remains limited in the public domain. The scale of the alleged theft, involving hundreds of millions of records, suggests a highly impactful operation if the claims are accurate.

About NADRA

NADRA, the National Database and Registration Authority, is the official government agency in Pakistan responsible for managing the nation's identity management and civil registration systems. The agency plays a critical role in national administration by collecting citizens' biometric data. Furthermore, NADRA is responsible for the issuance of essential official documents, including national identity cards and passports.

Impact and security implications for government institutions

This incident may pose a significant risk due to the exposure of sensitive data belonging to government institutions. The presence of personally identifiable information in the leaked data could lead to identity theft and targeted phishing attacks against the affected individuals. When large-scale databases containing biometric or identification information are compromised, the long-term consequences for individual privacy and national security can be profound.

The institution may face legal responsibilities under Pakistan's data protection regulations, and national security concerns may arise given the claims regarding military data. In such scenarios, ransomware actors may utilize such data for secondary gains, such as selling the information on dark web forums or using it for further social engineering campaigns.

To mitigate the impact of such breaches, organizations in the government and defense sectors typically need to conduct thorough forensic investigations to determine the full scope of the breach and notify the affected parties. Common defensive steps for organizations facing these threats include implementing robust multi-factor authentication, maintaining strict network segmentation, and ensuring comprehensive logging and monitoring to detect unauthorized data exfiltration in real-time. Additionally, regular security audits and incident response planning are essential components of a modern cybersecurity posture for high-value government targets.