www.merchant.id Listed by babuk2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 27 January 2025, the website www.merchant.id was listed by the ransomware group known as babuk2. Public reporting states that internal files were exfiltrated during a ransomware attack. The number of people affected remains unknown, and further operational details have not been disclosed.

This listing places the organisation among those claimed as victims by the group. Because the claim originates from a leak-site notice rather than independent confirmation, the precise scope and impact stay limited to what has been reported so far.

What happened

According to available records, www.merchant.id appeared on a babuk2 listing dated 27 January 2025. The reported summary identifies the organisation itself and states that internal files were exfiltrated in a ransomware attack. No public figures have been released for the volume of data taken, the exact date of intrusion, the initial access method, or whether a ransom demand was issued or paid. The number of individuals potentially affected is listed as unknown. Beyond the leak-site claim and the description of internal-file exfiltration, additional technical or forensic detail has not been made public.

Inside babuk2

Babuk2 is associated with the broader Babuk ransomware family, a group that has operated since at least 2021 and is known for double-extortion tactics. In typical operations the actors encrypt systems while simultaneously stealing data, then threaten to publish the material on a dedicated leak site if payment is not received. Public reporting on earlier Babuk campaigns has documented attacks against organisations in multiple sectors, often accompanied by timed data dumps and pressure communications. The group has historically used custom ransomware builds and has at times released source code or rebranded under successor names. In the present case the listing of www.merchant.id constitutes a claim by the group; no independent verification of the intrusion or the contents of any stolen archive has been supplied in the public record.

www.merchant.id and its sector

www.merchant.id operates under a domain that indicates involvement in merchant-related services, most commonly identity, onboarding, payment facilitation or business-verification functions. Organisations of this type routinely process commercial registration data, contact details, transaction records and supporting documentation for merchants and their customers. A compromise at such an entity can therefore touch both business-to-business relationships and end-user information that flows through merchant channels. Because these services sit at the intersection of commerce and identity, any confirmed exposure of internal files carries consequences for trust, regulatory compliance and operational continuity across the merchant ecosystem the organisation serves.

What was likely exposed

The only data type named in the available facts is “internal files exfiltrated in a ransomware attack.” No further inventory—such as customer databases, financial ledgers, authentication credentials or employee records—has been itemised. Organisations that provide merchant services typically hold business registration documents, contact information, payment-related identifiers and internal operational records. Whether any of those categories were among the files taken remains unconfirmed. Public detail is therefore limited to the general statement that internal material left the organisation’s control.

Why it matters

For individuals or businesses whose information may have been stored in the exfiltrated files, the principal risks include unsolicited contact, social-engineering attempts that reference genuine merchant relationships, and potential misuse of any identifiers that could support account takeovers or fraudulent applications. For the organisation itself, the incident raises questions of service continuity, contractual notification duties and the need to reassess access controls. Because the scale of the breach and the exact contents remain undisclosed, the concrete exposure for any single person or partner cannot yet be quantified; the listing alone is sufficient reason for heightened vigilance among those who have interacted with the service.

What to do if you're exposed

If you have used services connected to www.merchant.id, treat the possibility of data exposure as real until more information emerges. Practical first steps include:

• Monitor financial and merchant accounts for unexpected activity and enable multi-factor authentication wherever available.
• Be sceptical of unsolicited messages that reference merchant relationships or request urgent verification.
• Change passwords on any accounts that may have shared credentials with the affected service, using unique passphrases.
• Review recent statements and credit reports for signs of new accounts opened in your name.
• Run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets.

These measures do not reverse the incident, but they reduce the chance that any compromised internal material can be turned into further harm. Continue to watch for official statements from the organisation as additional confirmed detail becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.