Babuk2 ransomware group lists www.skywaycoach.ca on its leak site

• Ransomware group: Babuk2
• Country: Canada
• Sector: Transportation
• Announcement date: January 27, 2025

Babuk2 claims data breach at Skyway Coach Lines

The threat actor known as Babuk2 has announced that it has targeted Skyway Coach Lines, a transportation company based in Canada. According to an announcement made on January 27, 2025, the group alleges that it has successfully exfiltrated data from the organization's servers. The threat actor has provided a download link within their announcement for the data they claim to have stolen.

In the context of modern cyber threats, such announcements are a hallmark of ransomware groups that utilize double extortion tactics. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak the stolen data on public leak sites, these groups aim to pressure the victim into paying a ransom to prevent the exposure of confidential information.

Details of the alleged data exfiltration

The announcement made by the Babuk2 group specifies the types of information they claim to have acquired during their attack. The group alleges that the stolen dataset contains various types of sensitive information belonging to both the company and its stakeholders. According to the claims, the leaked data includes:

• Customer information
• Driver data
• Driver's licenses
• Bills

While the group has provided a link to the alleged stolen data, no specific information regarding the total size of the data breach or the total number of files involved has been provided in the announcement. Furthermore, the group has not disclosed a specific ransom demand in their public claim.

About Skyway Coach Lines

Skyway Coach Lines is a company operating within the transportation sector, based in Canada. The organization specializes in providing charter bus services to meet various transportation needs for its clients.

Impact and potential risks of the incident

The nature of the data claimed to be stolen suggests that this incident may pose significant secondary risks to the individuals involved. Specifically, the exposure of driver's licenses and personal information can lead to risks such as identity theft and fraud for the company's customers and employees. Such breaches often result in long-term consequences for the individuals whose private details are made public.

From a regulatory and operational standpoint, the incident carries several implications. As a company operating in Canada, Skyway Coach Lines may face legal obligations under data protection regulations, such as the Personal Information Protection and Electronic Documents Act (PIPEDA). The exposure of such sensitive information could have negative impacts on the company's operational security and its overall reputation.

Regarding the threat actor, information about the Babuk2 group remains limited. However, based on the typical methods employed by ransomware groups, the leaked data could potentially be used in broader phishing attacks in the future. In such cases, attackers use the stolen information to craft highly convincing fraudulent communications to target the victims further.

For organizations in the transportation and service sectors, maintaining robust cybersecurity posture is essential to mitigate these risks. Common defensive steps for organizations include implementing strict access controls, maintaining regular offline backups, and conducting thorough employee training to recognize phishing attempts. Furthermore, ensuring compliance with regional data protection laws is a critical component of managing the legal and reputational risks associated with potential data breaches.