Pensions.gov.lk listed on cloak ransomware leak site

• Ransomware group: cloak
• Country: Sri Lanka
• Sector: Government & Defense
• Announcement date: June 27, 2025

The ransomware group known as cloak has officially listed Pensions.gov.lk on its leak site. This announcement, made on June 27, 2025, involves a claim by the threat actor that they have successfully obtained data belonging to the organization.

The claim by cloak

On June 27, 2025, the cloak group published an announcement on their dedicated leak site targeting Pensions.gov.lk. According to the group's post, the organization has been compromised, and they claim to have access to its data. At this stage, public information regarding the specific identity, tactics, or background of the cloak group remains limited, making it difficult to establish a comprehensive profile of the threat actor.

Ransomware leak sites are a common component of modern cyber extortion campaigns. In many instances, these groups employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information before the encryption phase. The threat actors then use the threat of leaking this stolen data on their public or dark web leak sites as additional leverage to pressure the victim into paying a ransom. If the victim refuses to comply, the group threatens to release the data to the public, causing significant reputational and legal consequences.

Details of the alleged data breach

Despite the announcement made by the cloak group, there is currently no information available regarding the specific nature or categories of the alleged leaked data. The group has not provided any screenshots or samples to substantiate their claims or to demonstrate the contents of the data they purport to possess. Furthermore, there is no information available regarding the total size of the data or the specific file count involved in this incident.

• No specific data types have been named in the listing.

About Pensions.gov.lk

The Department of Pensions of Sri Lanka is the official government agency responsible for managing pension schemes and social security benefits for public sector employees in the country. The institution is tasked with processing pension claims and regulating services for retirees.

Potential impact and organizational implications

The claim that the organization's data has been leaked may pose a significant risk of exposing citizens' personal information. Such an exposure could potentially lead to individuals being targeted by identity theft or phishing attacks, as stolen personal identifiers are often used by malicious actors to conduct fraudulent activities. When attacks target government entities, they can create negative impacts on the continuity of essential services and compromise overall data privacy for the population.

If the incident is verified, it could trigger legal processes under national data protection regulations. Furthermore, the organization may face significant reputational damage resulting from the perceived failure to protect sensitive public data. For organizations operating within the government and defense sector, maintaining robust cybersecurity postures is critical to preventing such incidents.

To mitigate the risks associated with ransomware and data exfiltration, organizations typically implement several defensive layers. This includes maintaining rigorous patch management schedules to close vulnerabilities, implementing multi-factor authentication (MFA) across all access points, and conducting regular offline backups to ensure data recovery. Additionally, continuous monitoring of network traffic and employee security awareness training are essential components of a comprehensive defense strategy to detect and prevent unauthorized access before data can be exfiltrated.