babuk2 ransomware group lists zalora.sg (Singapore Shopping) on its leak site

• Ransomware group: babuk2
• Country: Singapore
• Sector: Retail & E-Commerce
• Announcement date: April 3, 2025

Babuk2 claims to have compromised zalora.sg

The threat actor known as babuk2 has announced a significant data breach involving the Southeast Asian e-commerce platform zalora.sg. According to an announcement made on a leak site on April 3, 2025, the group claims to have successfully conducted a cyberattack against the organization. The group asserts that they have obtained a substantial volume of information, specifically claiming to have acquired approximately 100 GB of documents and information files from the institution's database.

The threat actor stated that the stolen data is currently being offered for sale or has already been leaked. While the group has claimed responsibility for the incident, no specific ransom demand has been disclosed in the announcement. This type of activity is common in modern ransomware operations, where attackers often employ double extortion tactics. In such scenarios, attackers do not just encrypt an organization's systems but also exfiltrate sensitive data to use as leverage, threatening to publish or sell the information if the ransom is not met.

Details of the allegedly leaked data

The information allegedly stolen during the attack is extensive and covers various aspects of customer transactions and personal identification. According to the claims made by babuk2, the compromised data includes a wide range of sensitive details that could be used for malicious purposes. The specific types of data mentioned in the leak include:

• Email addresses
• Phone numbers
• Physical addresses
• Order numbers
• Tax information
• Cashback details
• Discount information
• Dates of birth
• Purchase history
• PDF invoices

The presence of such diverse data types, ranging from contact information to financial and purchase-related documents, significantly increases the potential impact of the breach on the affected individuals.

About zalora.sg

Zalora is a leading fashion and lifestyle e-commerce platform based in Southeast Asia. The company specializes in the online retail of clothing, footwear, and accessories from a wide range of brands. As a major player in the regional retail sector, the platform manages a vast amount of consumer data to facilitate its online shopping services.

Potential risks and industry implications

The alleged leak of this data carries significant risks for the customers of the platform. The combination of contact details, physical addresses, and purchase histories creates a high risk for identity theft and the execution of targeted phishing attacks. When attackers possess specific details like order numbers or previous purchase history, they can craft highly convincing fraudulent communications to deceive users.

For the organization, the consequences could be multifaceted. Given that the platform is based in Singapore, the incident may result in legal consequences under the Singapore Personal Data Protection Act (PDPA). Furthermore, the potential for financial fraud targeting the institution's customers could lead to a significant loss of brand reputation and consumer trust. Information regarding the specific capabilities and identity of the babuk2 group remains limited.

In the retail and e-commerce sector, such incidents highlight the ongoing necessity for robust cybersecurity frameworks. Organizations in this sector often face sophisticated threats aimed at harvesting customer data for secondary exploitation. To mitigate these risks, companies typically focus on implementing strong encryption for data at rest and in transit, enforcing multi-factor authentication, and maintaining rigorous monitoring of database access. Because attackers often use double extortion, the risk of secondary consequences increases significantly if the stolen data is successfully published or sold on the dark web.