Babuk2 ransomware group lists Taiwan - Mackay Hospital on its leak site

• Ransomware group: Babuk2
• Country: Taiwan
• Sector: Healthcare
• Announcement date: March 14, 2025

The Babuk2 ransomware group has announced a data breach involving Taiwan's Mackay Hospital. According to an announcement made on a leak site on March 14, 2025, the threat actor claims to have exfiltrated a significant amount of information belonging to the healthcare institution.

Details of the claimed attack

According to the claims made by the Babuk2 group, the attackers gained access to the internal systems of Mackay Hospital via the internet. Once inside the network, the group asserts that they successfully seized control of the Active Directory domain controller. This level of access typically allows attackers to move laterally through a network and escalate privileges.

The group further states that they deployed encryption software across the network, an action that resulted in the disruption of hospital operations. Following the encryption phase, the group claims they decided to leak the stolen information because the institution failed to comply with their ransom demands. The announcement suggests that the scope of the breach may extend across multiple locations, specifically mentioning data from the Hsinchu, Taitung, Tamsui, and Taipei hospital branches.

Information involved in the leak

The threat actor claims that the total volume of the stolen data is 120 GB. While the group has published this volume, they have not provided specific details regarding the exact content or the specific file types contained within the leaked dataset. It is noted that the 120 GB of data may contain hospital operational records and sensitive information.

The listing does not name any specific data types or individual files that were compromised.

About Mackay Hospital

Mackay Memorial Hospital is a well-established hospital and healthcare organization based in Taiwan. Rooted in Christian missionary foundations, the institution provides comprehensive medical services and academic medical education.

Analysis and potential impact

This incident highlights a significant risk of exposure for patient privacy and internal operational data within the hospital. When sensitive data is leaked, it can be utilized by malicious actors for various purposes, such as identity theft or targeted phishing attacks against employees or patients. Furthermore, the institution may face legal and administrative sanctions under Taiwan's data protection regulations due to the potential exposure of sensitive information.

The use of the double-extortion method—where attackers both encrypt data and threaten to leak it—is a tactic designed to increase pressure on an organization. This method can trigger secondary security risks even if an organization manages to restore systems from backups. In this specific case, public information regarding the Babuk2 group remains limited.

For organizations operating within the healthcare sector, such incidents underscore the importance of robust cybersecurity frameworks. Common defensive strategies often include implementing multi-factor authentication, maintaining strict network segmentation to prevent lateral movement, and ensuring that critical systems like Active Directory are heavily monitored and secured. Additionally, maintaining offline, immutable backups is a standard practice to mitigate the impact of encryption-based attacks. Because healthcare providers handle highly sensitive personal information, they are frequently targeted by ransomware groups seeking to leverage the criticality of their services to demand higher ransoms.