moh.gov.rw Listed by babuk2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 31, 2025, the website moh.gov.rw was listed by the ransomware group known as babuk2. Public reporting indicates that the group claims to have carried out a ransomware attack involving the exfiltration of internal files. The number of people affected remains unknown, and further details about the incident have not been confirmed in available records.

This listing matters because moh.gov.rw is associated with Rwanda’s Ministry of Health, an organisation that handles sensitive public-health information. Any confirmed exposure of internal files could affect individuals whose data the ministry holds and could disrupt related services, though the precise scope of what was taken is still unconfirmed.

What happened

According to the reported information, moh.gov.rw was listed by the babuk2 ransomware group on March 31, 2025. The group claims that internal files were exfiltrated as part of a ransomware attack. No confirmed figures have been released for the volume of data involved, the exact date the intrusion began, or the technical method used. The number of people affected is listed as unknown. Public detail beyond the leak-site listing itself remains limited, and the claim has not been independently verified in the available facts.

Who is babuk2?

Babuk2 is a ransomware operation that has appeared in public threat-intelligence reporting as a successor or rebranded variant linked to the earlier Babuk ransomware family. Groups of this type typically follow a double-extortion model: they encrypt systems and simultaneously steal data, then threaten to publish the stolen material on a leak site if a ransom is not paid. Babuk and related actors have previously targeted organisations across multiple sectors, often using publicly documented tactics such as exploiting remote-access services or unpatched vulnerabilities to gain initial entry, followed by lateral movement and data staging before encryption. These patterns are drawn from well-established public knowledge of the actor’s broader activity and should not be read as confirmed specifics of the moh.gov.rw incident. In this case, the group’s listing of the victim is simply a claim that internal files were taken; no further statements attributed to babuk2 about this particular organisation appear in the reported facts.

About moh.gov.rw

moh.gov.rw is the online presence of Rwanda’s Ministry of Health. As a national health ministry, the organisation is responsible for public-health policy, disease surveillance, healthcare delivery coordination, and the management of citizen health records and related administrative data. Organisations of this kind routinely process personal identifiers, medical histories, vaccination records, staff information, and operational documents that support hospitals, clinics, and public-health programmes. A breach involving such an entity is consequential because health-sector data is both sensitive and long-lived; unauthorised access can affect patient privacy, trust in public services, and the continuity of care systems. The facts do not establish any finding of negligence on the part of the ministry; they record only that the organisation has been listed by the ransomware group.

The information in question

The available facts state that the data types named as exposed are “internal files exfiltrated in ransomware attack.” No further breakdown—such as specific file names, databases, or categories of personal information—has been disclosed. The number of people affected is unknown. Health ministries typically hold a wide range of records, including patient demographics, clinical notes, staff credentials, procurement documents, and internal correspondence. Because the exact contents remain unconfirmed, it is not possible to state with certainty which of these categories, if any, were among the files the group claims to have taken. Readers should treat any assertion about particular data elements as unverified until official confirmation is provided.

Why it matters

If internal files from a health ministry are exposed, the practical risks include identity theft, targeted phishing that uses real personal or medical details, and potential misuse of health information that could affect employment, insurance, or personal safety. For the organisation itself, the consequences can include operational disruption, the cost of investigation and remediation, and erosion of public confidence in digital health services. Because the scale of the alleged exfiltration is unknown and the claim originates from a ransomware leak site, the actual impact cannot yet be measured. The incident nonetheless underscores the value of the data such ministries hold and the need for clear communication once more facts become available.

If your data was in this claimed breach

Until official confirmation of the data involved is released, individuals who have interacted with Rwanda’s Ministry of Health services should take measured steps to protect themselves. Concrete actions include:

• Monitor bank, email, and government-service accounts for unexpected activity or password-reset requests.
• Enable multi-factor authentication wherever it is offered, especially on email and health-portal logins.
• Be cautious of unsolicited messages that reference health records or ministry business; verify any such contact through official channels.
• Consider placing fraud alerts with credit-reporting services if you believe sensitive identifiers may have been involved.
• Run a free exposure scan of your email address to check whether it has already appeared in other known breach datasets.

These steps are precautionary. Public detail about the moh.gov.rw listing remains limited, and further official statements will be needed to clarify what, if anything, was actually compromised.

AICompiled with AI assistance from public sources and published under our editorial standards.