mtgazeta.uz Listed by Babuk2 Ransomware Group

On January 27, 2025, the Uzbek news outlet mtgazeta.uz appeared on the leak site operated by the Babuk2 ransomware group. Internal files were allegedly exfiltrated during a ransomware attack, and the group has published what it claims is proof of the breach. While the exact number of people whose personal information is contained in the files remains unknown, anyone whose data was held by the publication could now be exposed.

What Public Reporting Shows

Public reporting indicates that Babuk2 added mtgazeta.uz to its leak site on January 27, 2025. The group states it stole internal files during a ransomware incident and has begun releasing samples as part of its extortion process. No confirmed total of affected records has been released, and the precise data types inside the files have not been independently verified. Available reporting describes the incident as a classic ransomware attack that combined encryption of systems with data exfiltration for leverage.

Why This Matters for You and Your Family

When a news organization’s internal files are stolen, the information often includes names, contact details, addresses, phone numbers, and sometimes financial or employment records of sources, subscribers, employees, and their families. If your information was in those systems, criminals can use it to open accounts in your name, file fraudulent tax returns, or sell it on underground markets. For families this can mean sudden spam calls, targeted phishing texts to your children, or unexpected charges on shared household accounts. The breach is another reminder that ordinary people who interact with local news outlets, whether as readers, interview subjects, or staff, can find their private details exposed without warning.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently contain more than isolated records. They can link an email address to a full name, home address, phone number, and even notes about family members or children. Once that information reaches criminal forums, it becomes the foundation of an identity chain. Attackers combine it with credential leaks from other breaches to take over email accounts, social media profiles, and eventually gaming accounts. A single exposed work email can lead to your child’s Roblox or Minecraft handle being linked back to your home address, opening the door to harassment, swatting, or further extortion. Credential leaks like this one cascade into account takeovers and doxxing chains.

Babuk2’s Publicly Known Track Record

Public reporting attributes the Babuk2 operation to a ransomware group that emerged in the wake of the original Babuk gang’s dissolution. The group has targeted organizations across multiple countries, focusing on media outlets, healthcare providers, and small-to-medium businesses. Its typical playbook involves gaining initial access through phishing or exploited remote desktop protocols, exfiltrating data before deploying ransomware, and then pressuring victims with a dual extortion tactic: threatening to publish the stolen files while demanding payment to prevent encryption or further leaks. Babuk2 maintains an active leak site where it posts proof files and deadlines, a pattern consistent with its prior incidents.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used at mtgazeta.uz or related services and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your accounts.

The speed with which ransomware groups move stolen data means you cannot afford to wait for official notices that may never arrive. Taking concrete steps now limits how far this claimed breach can follow you or your family. DoxxScan by GalaxyWarden offers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to understand your exposure and begin closing the gaps.