ezbuy.sg (Singapore Shopping) Listed by babuk2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to list organisations on leak sites as part of double-extortion campaigns, claiming data theft even when the full scale remains unverified. In this environment, e-commerce platforms that handle customer and operational information have become frequent targets because of the volume of records they process daily.

On 3 April 2025, the ransomware group known as babuk2 listed ezbuy.sg (Singapore Shopping) among its claimed victims. Public detail is limited: the number of people affected is unknown, and the only data type named is internal files said to have been exfiltrated. The listing itself is a claim by the group and has not been independently confirmed in the available record.

Inside the incident

According to the reported information, ezbuy.sg (Singapore Shopping) was listed by the babuk2 ransomware group on 3 April 2025. The group asserts that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access method, the precise date of intrusion, the volume of data taken, or any ransom demand—have been disclosed in the public summary. The number of individuals potentially affected remains unknown. Because the listing originates from the threat actor’s own site, it must be treated as an unverified claim rather than established fact.

Inside babuk2

Babuk2 is associated with the Babuk ransomware family, which first gained attention in early 2021. Groups operating under this banner have historically employed double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if payment is not made. They have targeted a range of sectors, including manufacturing, logistics and professional services, often using custom encryption tools and leak sites to pressure victims. Public reporting has described Babuk operators as relatively sophisticated in their use of living-off-the-land techniques and selective targeting of larger organisations. Specific claims made by babuk2 about ezbuy.sg are limited to the listing itself and the assertion of internal-file exfiltration; no additional statements unique to this incident appear in the available facts.

Who is ezbuy.sg (Singapore Shopping)?

ezbuy.sg operates as an online shopping platform serving customers in Singapore and the wider region. E-commerce businesses of this type typically maintain customer accounts, order histories, payment-related records, supplier information and internal operational documents. A breach involving such a platform is consequential because the organisation sits at the intersection of consumer data and commercial logistics. Even when the exact contents of any stolen material remain unconfirmed, the mere possibility of internal files leaving the organisation raises questions about continuity of service, supplier relationships and customer trust.

The information in question

The available record states only that internal files were exfiltrated in a ransomware attack. No specific categories—such as customer names, email addresses, payment card data, or employee records—are named. Organisations in the online retail sector commonly hold personal contact details, purchase histories, shipping addresses and internal business documents. Because the precise contents have not been disclosed, it is not possible to confirm what, if anything, was taken beyond the general description of “internal files.” Readers should treat any more detailed claims circulating elsewhere as unverified until corroborated by the organisation or independent investigators.

Why it matters

For individuals, the practical risk depends on whether personal information was among the internal files. If customer or account data were included, affected people could face phishing attempts that reference real order details, or attempts to reuse credentials on other sites. For the organisation, the incident—if the group’s claim proves accurate—can disrupt operations, damage supplier and customer confidence, and trigger regulatory scrutiny under Singapore’s personal-data protection rules. Even when the scale is unknown, the listing alone can create lasting reputational pressure. Concrete steps such as monitoring account activity and reviewing recent communications remain the most useful immediate responses.

Were you affected?

If you have used ezbuy.sg, review recent account activity and change passwords that may have been reused elsewhere. Enable multi-factor authentication where available and treat unsolicited messages that reference orders or personal details with caution. Because the number of people affected and the exact data types remain unknown, there is no definitive public list of victims. Readers can run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets; such a check does not confirm involvement in this specific incident but can highlight earlier exposures that warrant attention.

AICompiled with AI assistance from public sources and published under our editorial standards.