ezbuy.sg (Singapore Shopping) Listed by babuk2 Ransomware Group

On April 3, 2025, Singapore-based online shopping platform ezbuy.sg appeared on the leak site of the Babuk2 ransomware group. Internal files were allegedly exfiltrated during a ransomware attack, and the company’s data is now publicly listed for anyone to download.

What's Publicly Reported from Reporting

Public reporting indicates that the Babuk2 group posted a notice claiming successful compromise of ezbuy.sg. The listing includes exfiltrated internal files, though the exact volume and full list of contents remain unconfirmed by independent verification. No specific victim count has been released by either the attackers or the company. The breach follows the group’s typical pattern of encrypting systems, exfiltrating data, and then publishing samples or full datasets when ransom demands are not met.

April 3, 2025 marks the public disclosure date on the Babuk2 leak site. The platform, which serves customers across Singapore for cross-border shopping, appears to have had internal operational files taken rather than a direct compromise of customer-facing databases. Available reporting describes the exposed material as internal documents, but does not yet detail whether customer records, payment information, or employee data were included.

Why This Matters for You and Your Family

When a shopping site you use suffers a breach, your personal details can quickly spread beyond that single company. If you have ever placed an order on ezbuy.sg, your name, delivery address, contact number, or email may sit inside the stolen files. These details become building blocks that identity thieves or harassers can combine with information from other breaches.

Internal files exfiltrated often contain more than just order history. They can hold customer service notes, shipping manifests, or even linked accounts. For families, this risk multiplies when children share the same household address or email domain. A single leak can expose the entire home to follow-on attacks ranging from phishing texts to physical mail scams.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently contain enough fragments to map one piece of information to another. An email from an ezbuy.sg order can be linked to a username on a forum, which then connects to a gaming account or social profile. Attackers call this chaining. Once they have the chain, they can impersonate you, reset passwords across services, or publish your family’s details online for harassment.

Credential leaks like this one cascade into account takeovers. A password reused from an old ezbuy.sg account can unlock email, banking, or your child’s Roblox or Minecraft profile. Gaming accounts are especially vulnerable because children often use simple passwords and parents rarely monitor them. The result is doxxing that starts with a shopping purchase and ends with strangers knowing where your family lives.

Babuk2 Group Track Record

Public reporting attributes Babuk2 as a rebranded or successor operation to the original Babuk ransomware gang that first appeared in 2021. The group has targeted hospitals, manufacturers, and retailers in multiple countries. Notable prior victims include healthcare providers and logistics companies whose internal documents were published after ransom negotiations failed.

Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by lateral movement inside the network to locate valuable files. After exfiltration, the group encrypts systems and posts samples on their leak site with a ransom deadline. If unpaid, they release larger portions or the entire archive. This extortion style relies on the fear of both operational disruption and public exposure of sensitive internal data.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have been exposed in the ezbuy.sg files.
• Rotate any password you ever used on ezbuy.sg anywhere else it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and addressed in hours, not months.
• Cover the household with DoxxScan family coverage that includes dependents and your children’s gaming accounts, which often chain back to the same home address or parent email.
• Let remediation specialists handle takedown requests for any personal information that has already reached data brokers or paste sites.

The ezbuy.sg incident shows how a single shopping breach can feed larger identity chains that threaten your privacy and safety at home. Taking concrete steps now limits the damage and reduces the chance that today’s leak becomes tomorrow’s harassment. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full family and household coverage including children’s gaming accounts.