nstda.or.th data allegedly leaked by Babuk2 ransomware group

• Ransomware group: Babuk2
• Country: Thailand
• Sector: Technology
• Announcement date: March 18, 2025

Babuk2 claims to have stolen data from nstda.or.th

The Babuk2 ransomware group has listed data on its leak platform that it claims belongs to nstda.or.th. In an announcement published on March 18, 2025, the group alleges that the data obtained from the institution's systems totals 8.31 GB. While the group has published this information on its leak site, public information regarding the specific operations and identity of this group remains limited.

Ransomware leak sites serve as a primary tool for cybercriminal groups to exert pressure on their victims. These platforms are used to host stolen data, often accompanied by countdown timers or specific demands, to coerce organizations into paying ransoms. When an organization refuses to comply with demands, the attackers move from simple encryption to a strategy known as double extortion. In a double extortion scheme, attackers not only lock the victim's systems but also steal sensitive information, threatening to release it publicly to maximize the psychological and reputational pressure on the target.

Details of the alleged data leak

According to the screenshots provided by the attackers, the allegedly leaked data is extensive and contains highly sensitive information. The group claims that the stolen datasets include a variety of medical and administrative records that could be highly damaging if exposed. The specific types of data mentioned in the claim include:

• User diagnosis information
• Hospital admission records
• FSCLAIM data
• Hospital numbers
• Procedure notes
• SMS transaction data
• SOAP notes
• Visit numbers

About the National Science and Technology Development Agency

The target of this alleged attack is the National Science and Technology Development Agency (NSTDA). The NSTDA is a government agency located in Thailand. Its primary mission is to support scientific and technological research, promote innovation, and facilitate the transfer of technology within the country.

Impact and assessment of the incident

The nature of the allegedly leaked data indicates that it contains sensitive personal information linked to the institution's healthcare service processes. The inclusion of diagnosis information, hospital records, and procedure notes suggests that the breach involves highly private medical details. This situation may increase the risk of affected individuals being exposed to identity theft and targeted phishing attacks, as stolen medical and contact information is highly valued by malicious actors for social engineering.

Furthermore, the disclosure of health data could lead to significant reputational damage and potential disruptions in service continuity for the institution. Because the data is linked to healthcare processes, the organization may also face legal obligations under data protection regulations in Thailand. The use of double extortion tactics by the Babuk2 group in this instance confirms their intent to use the threat of public disclosure to exert maximum pressure on the agency.

In the technology and research sectors, organizations often implement various defensive steps to mitigate such risks. These typically include maintaining robust backup solutions, implementing multi-factor authentication, and conducting regular security audits. Protecting sensitive data requires a layered defense strategy to ensure that even if a perimeter is breached, the most critical information remains encrypted and inaccessible to unauthorized parties.