Eservices.gov.zm targeted by Flocker ransomware group

• Ransomware group: Flocker
• Country: Zambia
• Sector: Government & Defense
• Announcement date: February 19, 2025

Flocker claims compromise of Eservices.gov.zm

The ransomware group known as Flocker has published an announcement on its leak site claiming to have successfully compromised the servers and data belonging to Eservices.gov.zm. According to the group's claims, the breach occurred around February 12, 2025, with the official announcement appearing on their platform on February 19, 2025. The group's post includes a countdown timer, a common tactic used by ransomware actors to pressure victims into meeting ransom demands.

In modern cyberattacks, ransomware groups often employ a strategy known as double extortion. This method involves not only encrypting an organization's files to disrupt operations but also exfiltrating sensitive data before the encryption process begins. By threatening to leak this stolen data on public forums or specialized leak sites, attackers aim to increase the pressure on the victim to pay the ransom. This approach shifts the leverage from simple operational disruption to the threat of permanent reputational damage and regulatory consequences.

Details of the alleged breach

According to the claims made by Flocker, the group managed to penetrate multiple layers of the target's infrastructure. The group states that they have gained access to the main servers, the internal network, and even the backup systems. This level of access suggests a significant breach of the organization's digital perimeter and internal security controls.

A critical detail provided by the group is that all data was allegedly exfiltrated prior to the encryption phase of the attack. This means that even if the organization has robust backup restoration capabilities, the threat of data exposure remains a primary concern. The group's claims regarding the scope of the exfiltration include the following:

• Main servers
• Backups
• Internal network

The listing does not specify the exact volume of data stolen or the specific file counts involved. Furthermore, no specific ransom demand has been publicly disclosed by the group in the available information.

Organization profile

Eservices.gov.zm is an entity owned by the Zambian government. It serves as a centralized digital platform designed to provide citizens and businesses with access to various online public services. As a centralized hub for government interactions, the platform plays a vital role in the digital infrastructure of the country.

Potential impact and security considerations

This incident may lead to a data breach that could affect the delivery and availability of public services. If the claimed data is indeed leaked, the organization may experience significant operational disruptions. While the exact nature and specific types of the leaked data remain unknown, the disclosure of sensitive information from a government entity carries the risk of undermining public trust in digital governance.

Furthermore, such leaks can increase secondary risks for the affected individuals, such as identity theft or the likelihood of targeted phishing campaigns. When sensitive government data enters the hands of malicious actors, it can be used to craft highly convincing social engineering attacks against citizens.

For organizations operating within the government and defense sector, maintaining rigorous security postures is essential. Common defensive steps to mitigate such risks include implementing strict network segmentation to prevent lateral movement, maintaining offline or immutable backups to protect against ransomware, and employing robust monitoring to detect unauthorized data exfiltration. Because public information regarding the Flocker group is limited, organizations must remain vigilant against their evolving tactics.