Forvismazars.com.fr targeted by Babuk2 ransomware group

• Ransomware group: Babuk2
• Country: France
• Sector: Financial Services
• Announcement date: March 11, 2025

Babuk2 claims to have leaked data from forvismazars.com.fr

The ransomware group known as Babuk2 has published an announcement on its leak site claiming to have leaked 33 GB of data belonging to forvismazars.com.fr. The threat actor alleges that the data was obtained following a successful attack on the institution.

According to the announcement published on March 11, 2025, the Babuk2 group claims to have obtained the institution's data after their ransom demands were not met. The group is utilizing a double extortion tactic, a common method used by modern ransomware operators. In a double extortion scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to publish stolen data, the attackers aim to exert maximum pressure on the victim to pay the ransom, even if the organization has robust backups to restore its systems.

The threat actor has issued a direct threat to the organization regarding the volume of data they possess. The group states that if the institution does not cooperate with their demands, they may publish an additional 1 Terabyte of data that they claim to possess. This escalation tactic is designed to increase the psychological and reputational pressure on the target.

Details of the claimed data leak

The announcement states that the leaked information consists of 33 GB of compressed data. While the specific file count was not provided in the leak site announcement, the group claims that the stolen archive contains sensitive information related to the organization's internal and external operations. The specific types of data claimed to be included in the leak are:

• Employee information
• Client data
• Financial records

The presence of such a diverse range of data types—encompassing personnel, customers, and financial history—indicates a high-impact breach if the claims are accurate. Such data is highly valuable on illicit forums and can be used for various malicious purposes.

Implications and organizational risks

This incident may pose significant risks to the institution's stakeholders, such as identity theft or targeted phishing attacks directed at the institution's clients and employees. When sensitive employee and client information is exposed, these individuals become primary targets for social engineering campaigns, where attackers use stolen details to gain trust and extract further credentials or funds.

Given that the institution is based in France, the confirmation of such a breach may lead to administrative sanctions and legal processes under the General Data Protection Regulation (GDPR). Regulatory frameworks like GDPR impose strict requirements on how organizations handle and protect personal data, and failures in these processes can result in substantial fines and legal liabilities.

The use of double extortion by Babuk2 increases the risk of secondary data leaks, as the group's primary goal is to exert continuous pressure on the institution. Furthermore, public information regarding the Babuk2 group remains limited, which can make it difficult for defenders to perform a comprehensive technical analysis. However, the nature of these claims suggests that there could have been lapses in the organization's data security processes.

For organizations operating within the financial services sector, such incidents highlight the necessity of robust defensive measures. To mitigate the risks associated with ransomware and data exfiltration, organizations typically implement multi-layered security strategies. These include maintaining offline, immutable backups, implementing strict access controls through the principle of least privilege, and employing continuous monitoring to detect unauthorized data movement. Additionally, regular security awareness training is vital to help employees recognize the phishing attempts that often follow a data breach. Strengthening incident response plans to specifically address data exfiltration scenarios is also a critical component of modern cybersecurity resilience.