Mandarin.com.br listed on Babuk2 ransomware leak site

• Ransomware group: Babuk2
• Country: Brazil
• Sector: Retail & E-Commerce
• Announcement date: March 10, 2025

The Babuk2 ransomware group has announced a data leak claim against Mandarin.com.br on their leak site. This announcement, made on March 10, 2025, suggests a significant breach involving the Brazilian retail and e-commerce entity.

The alleged attack and claims by Babuk2

On March 10, 2025, the Babuk2 group listed Mandarin.com.br on their leak site, claiming to have exfiltrated data from the organization. The threat actors assert that they have obtained a total of 14TB of data, which reportedly includes various corporate files. This type of activity is characteristic of modern ransomware operations, which often employ double extortion tactics. In such scenarios, attackers not only encrypt an organization's systems but also steal sensitive information, threatening to publish it on a public leak site to pressure the victim into paying a ransom.

The group has issued a specific ultimatum regarding the stolen information. They state that if the organization does not initiate contact, they may publish approximately 900GB of sensitive information. While the group has made these claims, public information regarding the specific identity and technical capabilities of the Babuk2 group remains limited.

Data types reportedly involved in the leak

The announcement claims the leak includes a wide variety of sensitive materials. According to the threat actors, the exfiltrated data contains:

• SAE system approval reports
• Emails
• Personal documents
• FTP transfer logs
• Archives
• Business data

Furthermore, it is alleged that information related to various third-party companies may be included in the exfiltrated data. This potential inclusion of external data increases the scope of the incident, as it suggests the breach may extend beyond the primary target's immediate infrastructure.

Implications and potential risks

This alleged leak may pose significant data privacy risks to the organization's clients and business partners. Because the data reportedly includes personal documents and email contents, the organization may face data breach notification obligations under Brazil's LGPD regulations. Such regulatory frameworks are designed to protect individual privacy and require companies to act transparently when sensitive information is compromised.

The inclusion of alleged third-party company data could create opportunities for supply chain attacks and targeted phishing campaigns. When attackers gain access to business data and communication logs, they can often craft highly convincing social engineering attacks against partners or customers. The organization may need to initiate a comprehensive forensic investigation to determine the actual nature and extent of the compromised data.

Potential secondary risks associated with this incident include identity theft and significant damage to corporate reputation. As organizations in the retail and e-commerce sector handle vast amounts of consumer information, they are frequent targets for such campaigns. To defend against these threats, organizations typically implement defensive measures such as robust encryption, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized data transfers.