nhbg.com.co targeted in alleged data breach by Babuk2 ransomware group

• Ransomware group: Babuk2
• Country: Colombia
• Sector: Healthcare
• Announcement date: January 27, 2025

Babuk2 claims to have leaked data from nhbg.com.co

The ransomware group known as Babuk2 has listed the Colombian organization nhbg.com.co on its dedicated leak site. In an announcement dated January 27, 2025, the threat actor group claimed to have successfully exfiltrated a massive amount of data belonging to the institution. This incident highlights the ongoing risks faced by critical infrastructure and healthcare providers by sophisticated ransomware collectives.

Ransomware attack patterns often involve a process known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to publish private information on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential records. This tactic significantly increases the pressure on organizations, as the damage from a data leak can persist long after the initial technical disruption is resolved.

Details of the alleged theft

According to the announcement made by the Babuk2 group, the volume of stolen information is substantial. The group claims to have obtained a total of 3 TB of data from the organization. To support these claims and demonstrate the validity of the breach, the group has provided sample files to the public. These samples allegedly contain sensitive information pertaining to the various medical and operational services provided by the institution.

The specific types of data mentioned in the claim suggest a wide-ranging compromise of medical and administrative information. The leaked data is said to include information related to several critical healthcare areas, such as:

• Medical records
• Radiological images
• Laboratory results

The scope of the alleged data includes information regarding intensive care, emergency services, cardiovascular diagnostics, digestive endoscopy, clinical laboratory, hemodynamics, and radiological imaging. Based on the screenshots provided by the attackers, the data appears to encompass both operational and medical records, which could represent a significant breach of privacy.

About nhbg.com.co

The organization involved, nhbg.com.co, is identified as Nuevo Hospital de Bocagrande. According to the organization's profile, NHBG (Nueva Escuela de Hotelería y Gastronomía) is a hospitality and gastronomy educational institution based in Colombia. It offers vocational training programs in culinary arts and hotel management.

Potential impact and organizational risks

This alleged breach may pose significant risks to the institution's patient privacy and its established data security protocols. The exposure of sensitive health data can lead to severe consequences, such as identity theft or the execution of targeted phishing attacks against the individuals whose information was compromised. Furthermore, the institution may face various legal obligations under the data protection regulations governing Colombia.

While information regarding the specific mechanics and identity of the Babuk2 group remains limited, the sensitivity of the alleged data suggests that the impact could be profound. Such incidents can lead to negative consequences for the institution's operational continuity and may result in a loss of patient trust. For organizations operating within the healthcare sector, maintaining robust cybersecurity defenses is essential to protect patient confidentiality and ensure the integrity of medical services.

To mitigate such risks, organizations in this sector typically focus on implementing comprehensive security frameworks. This includes maintaining strict access controls, ensuring regular backups of critical data, and conducting continuous monitoring of network traffic to detect unauthorized exfiltration. Additionally, training staff to recognize social engineering attempts is a vital component of a defensive strategy against the initial stages of a ransomware attack.