icmr.gov.in Listed by babuk2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose personal or professional details sit inside Indian government health systems may now face uncertainty after a ransomware group publicly claimed to have taken internal files from icmr.gov.in. When medical-research infrastructure is listed on a leak site, the practical stakes are immediate: the possibility that contact information, research records or administrative data could be used for fraud, phishing or further targeting, even while the exact scale remains unconfirmed.

On 17 March 2025 the domain icmr.gov.in appeared on a listing attributed to the babuk2 ransomware group. Public detail is limited to the claim that internal files were exfiltrated; the number of people affected is unknown and no further confirmation has been released by the organisation.

Inside the incident

According to the available record, icmr.gov.in was listed by the babuk2 ransomware group on 17 March 2025. The sole description provided is that internal files were allegedly exfiltrated in a ransomware attack. No technical method of intrusion, no timeline of the compromise, no ransom demand amount and no volume of data have been disclosed in the public facts. The number of individuals potentially affected is listed as unknown. The listing itself constitutes a claim by the group; independent verification of the breach or of the contents has not been supplied in the reported material.

Who is babuk2?

Babuk2 is associated with the broader Babuk ransomware family, a set of operators that first gained public attention in 2021 for double-extortion attacks. In the established pattern used by such groups, attackers encrypt systems and simultaneously steal data, then threaten to publish the material on a dedicated leak site if a ransom is not paid. Babuk-linked actors have historically targeted organisations across government, healthcare and enterprise sectors, often posting sample files or full archives to pressure victims. Public reporting has documented their use of custom ransomware binaries and negotiation portals. In the present case the group claims to have listed icmr.gov.in and to have exfiltrated internal files; no additional statements specific to this victim appear in the given facts, and the claim remains unverified by independent sources.

About icmr.gov.in

icmr.gov.in is the online presence of the Indian Council of Medical Research, the apex body in India for the formulation, coordination and promotion of biomedical research. As a government organisation operating in the health and medical-research sector, it routinely handles scientific datasets, administrative records, correspondence with research institutions, and information linked to public-health programmes. Organisations of this type typically store personnel details, project documentation, grant information and, in some cases, anonymised or identifiable health-related data. A successful intrusion into such an environment is consequential because the data can touch both institutional operations and the privacy of researchers, staff and, potentially, members of the public who participate in studies.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of file types, no count of records and no confirmation of personal identifiers have been released. Organisations such as a national medical-research council commonly hold internal administrative documents, research protocols, staff directories, email archives and project-related materials. Whether any of those categories were among the files claimed by babuk2 is unconfirmed. The precise contents therefore remain undisclosed; readers should treat any assumption about specific data elements as speculative until official clarification appears.

Why it matters

For individuals whose information may reside in the affected systems, the concrete risks include targeted phishing that references genuine internal details, identity-related fraud if contact or identity data were present, and longer-term exposure if research or administrative records surface on criminal forums. For the organisation itself, the incident raises operational concerns: potential disruption of research workflows, the need to assess residual access by attackers, and the reputational and regulatory implications of a claimed data theft. Because the number of people affected is unknown and the exact data types are not enumerated, the full scope of harm cannot yet be measured; the absence of those figures itself increases uncertainty for anyone connected to ICMR systems.

If your data was in this claimed breach

If you have ever interacted with icmr.gov.in or related Indian medical-research programmes, treat the listing as a prompt for basic hygiene rather than confirmed personal exposure. Practical first steps include:

• Monitor financial and email accounts for unexpected activity or password-reset attempts.
• Enable multi-factor authentication on any accounts that reuse credentials you may have used with government or research portals.
• Be sceptical of unsolicited messages that reference ICMR projects, grants or health data and that urge immediate action.
• Request a free exposure scan of your email address to check whether that address has already appeared in other known breach datasets.

Official confirmation from the organisation, if and when it is issued, will provide the most reliable guidance on next steps. Until then, limited public detail means caution without panic remains the most useful posture.

AICompiled with AI assistance from public sources and published under our editorial standards.