Babuk2 ransomware group lists www.rekamy.com on its leak site

• Ransomware group: Babuk2
• Country: Malaysia
• Sector: Technology
• Announcement date: January 27, 2025

Babuk2 claims data breach at Rekamy

The Babuk2 ransomware group has announced that it has gained access to data belonging to the technology company Rekamy. According to an announcement made on a ransomware leak site on January 27, 2025, the group claims to have successfully infiltrated the networks of the organization.

The group asserts that the breach occurred on January 27, 2025. In their communication, the threat actors claim to have obtained various types of information from different companies that are hosted within the institution's network. The group has stated that if their ransom demand is not met, all files and databases containing sensitive information will be leaked to the public.

Details of the alleged compromise

The announcement made by the Babuk2 group specifies that several categories of sensitive information hosted on the network have been compromised. The group claims to have obtained access to various documents and data types that could impact the privacy of the entities hosted by the organization. Specifically, the group claims to have accessed the following types of data:

• Customer information
• Payment data
• Personally identifiable information (PII)

While the group has made these claims, the specific volume of the data and the total number of files involved have not been disclosed in the announcement. Furthermore, no specific ransom demand has been identified in the public listing.

About Rekamy

Rekamy is a Malaysia-based digital advertising and technology company. The organization provides online advertising solutions and digital marketing services to its clients.

Risk assessment and potential impact

This incident may pose secondary risks such as identity theft and fraud for the institution's customers and partners. The alleged compromise of personal data may trigger legal obligations under Malaysia's Personal Data Protection Act (PDPA). Because the institution provides SaaS services, this situation may be considered an additional risk factor regarding supply chain attacks.

Public information regarding the Babuk2 group remains limited. If the stolen data is released, targeted phishing attacks against the affected parties may be observed. In such scenarios, threat actors often use stolen information to craft highly convincing messages to deceive victims.

Ransomware attacks of this nature often involve a tactic known as double extortion. In this model, attackers do not only encrypt the victim's systems to disrupt operations but also steal sensitive data to use as leverage. The threat of leaking sensitive information on a public leak site is a primary tool used by these groups to pressure organizations into paying a ransom. This method increases the pressure on companies, as they face not only operational downtime but also significant reputational damage and potential legal consequences.

For organizations operating in the technology and SaaS sectors, such incidents highlight the importance of robust security postures. Protecting against supply chain risks is critical, as a breach in one service provider can potentially impact a wide array of downstream customers. Defensive measures typically include implementing strict access controls, maintaining comprehensive logging and monitoring, and ensuring that data is encrypted both at rest and in transit. Additionally, regular audits and compliance with local data protection regulations, such as the PDPA in Malaysia, are essential components of a modern cybersecurity strategy to mitigate the impact of potential leaks.