skopje.gov.mk Listed by babuk2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target public-sector websites and municipal systems, treating government digital infrastructure as high-value targets for data theft and extortion. In this environment, listings on leak sites serve as both pressure tactics and public signals that internal material may have left an organisation’s control. The reported listing of skopje.gov.mk by the group known as babuk2 fits this pattern and warrants careful attention from residents, staff and anyone who has interacted with the city’s online services.

Public reporting on 27 January 2025 indicated that skopje.gov.mk had been named by babuk2 in connection with a ransomware attack involving the exfiltration of internal files. The number of people affected remains unknown, and many operational details have not been confirmed. What is known is limited, yet the potential consequences for a municipal government platform make the incident worth examining on the available facts alone.

What happened

According to the available record, skopje.gov.mk was listed by the babuk2 ransomware group on or around 27 January 2025. The report states that internal files were exfiltrated in a ransomware attack. No further Reported Details have been provided about the precise date of intrusion, the initial access method, the volume of data taken, or whether systems were encrypted in addition to the theft of files. The number of individuals whose information may have been involved is listed as unknown. Public detail is therefore limited to the claim of a listing and the characterisation of the material as internal files obtained through ransomware activity. No independent verification of the full scope has been included in the reported facts.

The group behind it: babuk2

Babuk2 is associated with the broader Babuk ransomware family, a set of operators that have historically practised double-extortion tactics: encrypting systems while simultaneously stealing data and threatening to publish it if a ransom is not paid. Public reporting over several years has documented Babuk and related variants targeting organisations across multiple sectors, often advertising victims on dedicated leak sites to increase pressure. These groups typically seek administrative access, move laterally, and exfiltrate files before or during encryption. The listing of skopje.gov.mk is presented by the group as evidence of a successful operation; it remains an unverified claim unless confirmed by the victim organisation or independent forensic findings. No specific statements attributed to babuk2 about the contents of this particular breach beyond the general claim of internal-file exfiltration appear in the available facts.

About skopje.gov.mk

skopje.gov.mk is the official web presence of the City of Skopje, the capital of North Macedonia. Municipal government sites of this kind typically provide public information, online services, forms, and portals used by residents, businesses and city employees. They commonly hold or process administrative records, correspondence, planning documents, citizen contact details, and internal operational files. A breach affecting such a platform is consequential because it can expose both internal government workings and personal information belonging to people who rely on city services. Even when the exact holdings are not publicly itemised, the sensitivity of municipal data makes any confirmed or claimed compromise a matter of public interest.

What data was at risk

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No more granular inventory—such as specific document types, databases, or categories of personal data—has been disclosed. Organisations of this nature routinely maintain internal correspondence, policy drafts, staff records, service-request logs, and citizen-facing data that may include names, addresses, contact details and case-related information. Because the precise contents remain unconfirmed, it is not possible to state with certainty which of these categories, if any, were among the files taken. Readers should treat any assumption about exact data types as speculative until official clarification is issued.

The real-world impact

For individuals, the primary risks associated with municipal internal-file exposure include identity-related misuse, targeted phishing that references genuine city interactions, and the potential disclosure of personal circumstances recorded in administrative systems. Even limited internal documents can supply attackers with enough context to craft convincing social-engineering messages. For the organisation itself, consequences can include operational disruption, loss of public trust, the cost of investigation and remediation, and possible regulatory or legal obligations to notify affected parties. Because the number of people affected is unknown and the full data set is undisclosed, the scale of these risks cannot yet be quantified. The listing alone, however, creates a period of uncertainty during which both residents and staff may need to treat communications purporting to come from city systems with heightened caution.

If your data was in this claimed breach

If you have used services or submitted information through skopje.gov.mk, treat the possibility of exposure seriously even while details remain limited. Monitor bank and credit accounts for unusual activity, enable multi-factor authentication on email and government-related accounts, and be sceptical of unexpected messages that reference city services or request personal confirmation. Change passwords on any accounts that reused credentials associated with municipal portals. Keep records of any suspicious contact. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets; such checks provide an additional early-warning layer while official notifications, if any, are still pending.

AICompiled with AI assistance from public sources and published under our editorial standards.