movistar.com.pe Listed by babuk2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 14, 2025, the ransomware group babuk2 listed movistar.com.pe on its leak site, claiming responsibility for a ransomware attack in which internal files were exfiltrated. Public reporting so far provides no confirmed figure for the number of people affected, and further operational details remain limited. For customers and partners of a major Peruvian telecommunications provider, the listing raises immediate questions about what information may have left the organisation’s systems and what practical steps follow.

The claim itself is the primary public fact available. No independent confirmation of the full scope or method has been detailed in the available record, so the incident is treated here as an unverified listing by the group rather than a fully corroborated event.

Breaking down the breach

According to the reported information, movistar.com.pe was listed by the babuk2 ransomware group on March 14, 2025. The group asserts that internal files were exfiltrated as part of a ransomware attack. No public figure has been given for the volume of data taken, the number of systems involved, or the precise timeline of the intrusion. The number of people potentially affected is listed as unknown. Method of initial access, duration of presence inside the network, and any ransom demand details are undisclosed in the available facts. The core public record consists of the group’s leak-site claim and the characterisation of the material as internal files obtained through ransomware activity.

Who is babuk2?

Babuk2 is associated with the broader Babuk ransomware family, a group that has operated since approximately 2021 using a double-extortion model. In this approach, operators encrypt systems while also stealing data, then threaten to publish the stolen material on dedicated leak sites if a ransom is not paid. The original Babuk group gained attention for targeting large enterprises and for releasing portions of its source code, after which related or successor activity continued under similar branding. Public reporting on the group consistently describes the use of leak-site listings as pressure tactics and the selective release of sample files to demonstrate possession of data. In the present case, the listing of movistar.com.pe is treated strictly as a claim by the group; no additional statements attributed specifically to this victim beyond the fact of the listing and the description of exfiltrated internal files appear in the available record.

Who is movistar.com.pe?

Movistar.com.pe is the Peruvian online presence of Movistar, a major telecommunications brand operating under the Telefónica group. The company provides mobile telephony, fixed-line services, broadband internet, and related digital products to residential and business customers across Peru. Organisations of this type routinely manage large volumes of customer account data, billing records, service usage information, and internal operational files. Because telecommunications providers sit at the centre of everyday communication and identity verification for millions of people, any confirmed compromise of their systems carries wider consequences for customers, employees, and partner organisations that rely on the integrity of those records.

What was likely exposed

The available facts state only that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, databases, or specific categories of personal information has been disclosed. Telecommunications operators typically hold customer names, national identity numbers, contact details, service addresses, payment information, call or data usage records, and internal corporate documents such as contracts, employee records, and network configuration material. Whether any of those categories were among the files claimed by babuk2 remains unconfirmed. Exact contents are therefore unknown, and any assessment of exposure must treat the group’s assertion of “internal files” as the sole named description.

What's at stake

For individuals whose data may have been among the internal files, the concrete risks include potential misuse of personal identifiers for fraud, unsolicited contact, or credential-stuffing attempts against other services. Even limited internal documents can contain enough contextual information to enable social-engineering attacks. For the organisation itself, the stakes involve operational disruption from any encryption component of the ransomware, regulatory scrutiny under Peruvian data-protection rules, and the longer-term erosion of customer trust if sensitive material is later published. Because the number of affected people is unknown and the precise data set is undisclosed, the full scale of these risks cannot yet be quantified. The listing alone, however, places both customers and the company in a position of heightened vigilance until more definitive information emerges.

Were you affected?

If you hold an account or have done business with movistar.com.pe, treat the listing as a prompt to review your own exposure. Change passwords associated with any Movistar services and enable multi-factor authentication where available. Monitor bank and credit statements for unexpected activity and be cautious of unsolicited messages that reference your account or personal details. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. Keep records of any unusual communications and report confirmed fraud to the relevant Peruvian authorities. Further public updates from the company or independent investigators will clarify the situation; until then, the practical steps above remain the most direct response available to individuals.

AICompiled with AI assistance from public sources and published under our editorial standards.