moh.gov.rw Listed by babuk2 Ransomware Group

On March 31, 2025, the Rwandan Ministry of Health website moh.gov.rw appeared on the leak site operated by the Babuk2 ransomware group, with attackers claiming to have exfiltrated internal files during a ransomware incident.

What's Publicly Reported from Reporting

Public reporting indicates the Ministry of Health’s systems were compromised in a ransomware attack. The Babuk2 group posted details of the breach on its dark-web leak site, listing moh.gov.rw and stating that internal files had been taken. The exact number of records exposed remains unknown, and the specific types of data have not been publicly detailed beyond the general description of internal files. No evidence has surfaced showing that patient medical records were published, but the incident is classified as high severity because government health ministries routinely hold sensitive personal information about citizens.

Available reporting describes the posting as part of Babuk2’s standard tactic of pressuring victims by threatening to release stolen data. The primary source remains the group’s own leak page, hosted on an onion domain and mirrored by ransomware-tracking services such as ransomware.live.

Why This Matters for You and Your Family

When a national health ministry suffers a breach, ordinary citizens and their families are often the ones whose information ends up at risk. Government health databases can contain names, national ID numbers, addresses, phone numbers, medical history, insurance details, and family member information. Once that data leaves official control, it can be sold, traded, or used to target you with fraud, phishing, or identity theft.

Credential leaks from one government system frequently cascade into personal email accounts, banking logins, and even children’s online gaming profiles. If your family’s details were part of the Ministry of Health’s records, the exposure creates a long-term privacy problem that does not disappear when the news cycle moves on.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at one dataset. They look for connections between leaked government records and your everyday online activity. A phone number or email address taken from a health ministry file can be linked to your social-media handles, shopping accounts, or a child’s Roblox or Fortnite username. These identity chains allow attackers or data brokers to build detailed profiles that lead to doxxing, harassment, or targeted scams.

Children’s gaming accounts are especially vulnerable because kids often reuse simple passwords or email addresses tied to family information. A breach like this one can therefore expose the entire household, turning a single government incident into months or years of potential follow-on attacks.

Babuk2’s Publicly Known Track Record

Public reporting attributes the Babuk2 ransomware group’s emergence to late 2024. The group has claimed responsibility for attacks on healthcare providers, local governments, and educational institutions. Its typical playbook begins with initial access through phishing or exploited remote desktop services, followed by exfiltration of internal documents, and then extortion via leak-site pressure rather than widespread encryption. Babuk2 has repeatedly listed victims on its onion blog when ransom demands are not met, releasing sample files to demonstrate the legitimacy of the theft.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, government IDs, and online handles so you can see exactly what chains back to the moh.gov.rw breach.
• Rotate any password you used on Rwandan government health portals or anywhere else you reused that same credential, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the weakest link in doxxing chains after credential leaks like this one.
• Let remediation specialists handle takedown requests for any exposed personal records that appear on data-broker or underground sites.

The most important step you can take is to treat this claimed breach as the start of a potential chain of exposures rather than a one-time event. Start your DoxxScan trial today and combine it with immediate password hygiene and household-wide coverage; DoxxScan’s continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and family protection including children’s gaming accounts give you and your family a practical way to reduce the long-term risk created by incidents like the March 2025 compromise of moh.gov.rw.