The Ticktin Law Group targeted by Babuk2 ransomware group

• Ransomware group: Babuk2
• Country: United States
• Sector: Professional Services
• Announcement date: March 21, 2025

Babuk2 claims data theft from The Ticktin Law Group

The ransomware group known as Babuk2 has announced a significant data breach involving The Ticktin Law Group. According to an announcement made on a leak site on March 21, 2025, the threat actor claims to have gained unauthorized access to the systems of the US-based professional services firm. The group alleges that they have successfully exfiltrated a massive volume of data, totaling 5 TB, which they intend to use as leverage in their extortion attempt.

The incident follows a common pattern observed in modern cyberattacks known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption process begins. The goal is to threaten the victim with the public release of this stolen data if a ransom is not paid. This tactic significantly increases the pressure on the target organization, as the threat of a data leak can cause irreparable reputational and legal damage.

As of the announcement, the group has already published a 187 GB portion of the stolen information on its dedicated leak site. The threat actor has issued a warning to the organization, stating that if negotiations are not initiated, the entire 5 TB dataset may be released to the public. Information regarding the specific identity and technical capabilities of the Babuk2 group remains limited in the public domain.

Details of the alleged data exfiltration

The scale of the claimed theft is substantial, with the group asserting that the stolen information includes a wide variety of sensitive materials. While the total volume of the breach is claimed to be 5 TB, the specific contents of the files have not been fully detailed beyond the initial leak. The data allegedly stolen from the law firm includes several categories of highly sensitive information:

• Email databases
• Financial documents
• Internal company documents
• Customer data
• Employee data

The exposure of such diverse datasets is a hallmark of targeted attacks against professional service providers. When email databases and internal documents are compromised, the integrity of an organization's communication and operational security is severely undermined.

The Ticktin Law Group profile

The Ticktin Law Group is a law firm based in the United States that provides services in various legal areas. It primarily operates in fields such as commercial litigation, real estate law, and consumer rights.

Potential impact and industry implications

The alleged leak poses several secondary risks that could impact the organization's clients and employees. For the individuals whose data has been compromised, there is a heightened risk of identity theft and the possibility of receiving highly targeted phishing attacks. Because the stolen data reportedly includes email databases and customer information, attackers can craft convincing social engineering campaigns to further exploit the victims.

Given that The Ticktin Law Group operates within the legal sector, the exposure of this data could potentially violate client confidentiality, which is a cornerstone of legal practice. Furthermore, because the organization is based in the United States, the breach may trigger legal proceedings under relevant state laws and federal data protection regulations. The threat of a full data release could lead to significant reputational damage and cause major disruptions to the organization's operational processes.

In response to such threats, organizations in the professional services sector often focus on strengthening their defensive postures. This typically involves implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication across all access points, and maintaining rigorous monitoring of network traffic to detect unauthorized data exfiltration. Additionally, comprehensive incident response plans and regular employee training on phishing awareness are critical components for mitigating the impact of such high-stakes extortion attempts.