Dardoc.com targeted by Babuk2 ransomware group

• Ransomware group: Babuk2
• Country: Denmark
• Sector: Professional Services
• Announcement date: April 2, 2025

The Babuk2 ransomware group has announced on their leak site that they have successfully exfiltrated a significant amount of data belonging to Dardoc.com. According to the group's announcement, the breach involves a substantial volume of sensitive information, which they claim to have accessed and subsequently posted for public viewing.

Details of the claimed attack

The incident was officially announced by the Babuk2 group on April 2, 2025. According to the claims made by the threat actors, they managed to gain unauthorized access to the systems of Dardoc.com, a professional services organization. The group asserts that the breach occurred around November 25, 2024, though this timeline remains a claim made by the attackers.

The scale of the alleged data theft is considerable. The Babuk2 group claims to have obtained approximately 620 GB of documents from the organization's internal systems. While the group has provided the total size of the data, they have not provided information regarding the specific file count or the amount of a ransom demand. Publicly available information regarding the specific operational details and background of the Babuk2 group remains limited, making it difficult to ascertain more about their specific methodologies beyond this claim.

Data types involved in the leak

The information shared by the group includes a wide variety of sensitive documents. Based on the sample documents provided in the leak, the data appears to contain highly personal and sensitive information. The leaked content includes:

• Personal identification information
• Passport details
• Residence information
• Medical records
• Employment history

The inclusion of such diverse data types, particularly medical and identification records, highlights the potential sensitivity of the information involved in this alleged breach.

Impact and assessment

The publication of this data via double extortion tactics—a method where attackers both encrypt data and threaten to leak it to pressure victims—can lead to significant reputational damage for the targeted organization. In this specific case, the alleged leak of sensitive personal information significantly increases the risk of identity theft and targeted phishing attacks for the individuals whose data was compromised.

Because Dardoc.com is based in Denmark, the incident may lead to data protection violations under the General Data Protection Regulation (GDPR). The presence of medical records within the leaked dataset could trigger additional legal scrutiny regarding the protection of sensitive personal data. In such scenarios, organizations often find it necessary to conduct a comprehensive forensic investigation to determine the full scope and technical details of the breach.

For organizations operating within the professional services sector, maintaining robust security postures is critical to mitigating these risks. Common defensive steps often include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to defend against the phishing attempts that often follow such leaks. Furthermore, ensuring strict compliance with data protection frameworks is essential to manage the legal and regulatory consequences that arise from potential data exposure.