Highwirepress.com targeted by Babuk2 ransomware group

• Ransomware group: Babuk2
• Country: United States
• Sector: Technology
• Announcement date: March 18, 2025

Babuk2 claims data breach at highwirepress.com

The Babuk2 ransomware group has announced that it has allegedly exfiltrated approximately 26 million rows of data belonging to highwirepress.com. This announcement was made on the group's leak site on March 18, 2025, marking a significant alleged security incident for the organization.

In the incident announcement, the Babuk2 group listed highwirepress.com and claimed to have stolen data from numerous entities that utilize the services provided by HighWire Press. These affected entities reportedly include universities, schools, and medical centers. The group provided a file tree structure illustrating the allegedly stolen data and included an email address intended for the organization to use for contact. Publicly available information regarding the specific details and identity of this threat actor group remains limited.

Alleged data types and scope of the leak

The scope of the alleged breach is substantial, with the group claiming to have accessed 26 million rows of data. According to the file tree structure provided in the group's announcement, the stolen information is said to include various sensitive datasets. The specific types of data allegedly involved in this incident include:

• Subscription details
• Membership data
• Institutional administrative data
• Academic publication data

The presence of such a vast amount of data within a single breach can lead to significant downstream consequences for the entities involved, particularly when the data spans multiple sectors such as education and healthcare.

About highwirepress.com

HighWire Press is a company that provides digital publishing platforms and technology solutions for academic and research publishers. It offers software services that help publishers manage, host, and deliver their content online.

Risk assessment and industry implications

The potential exposure of data involving academic and medical institutions may pose a significant risk to personal privacy. Given that the organization's operations are based in the United States, such a breach could trigger legal proceedings under relevant state laws and federal regulations. The alleged 26 million rows of data could potentially be utilized by malicious actors for identity theft and targeted phishing campaigns.

Furthermore, a supply chain risk may be observed for the third-party institutions served by the company. When a service provider that manages content for various institutions is compromised, the impact extends beyond the primary target to its entire client base. This creates a ripple effect where the security of many organizations is tied to the security of a single provider.

The group's threat to publish the data may create double-extortion pressure on the organization. Double extortion is a common tactic used by ransomware groups where, after encrypting an organization's systems, they also threaten to release sensitive data publicly unless a ransom is paid. This tactic aims to maximize leverage over the victim by threatening reputational damage and regulatory fines. Such pressure can negatively impact an organization's operational continuity and overall stability.

In response to such threats, organizations in the technology and publishing sectors often focus on strengthening their defensive posture. Common defensive steps include implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication across all administrative access points, and maintaining rigorous patch management schedules. Additionally, organizations often conduct regular audits of third-party access to ensure that the principle of least privilege is maintained, reducing the potential impact of a supply chain compromise.