parliament.iq Listed by Babuk2 Ransomware Group

On March 14, 2025, the official website of the Iraqi Parliament, parliament.iq, appeared on the leak site of the Babuk2 ransomware group. Internal files were allegedly exfiltrated during a ransomware attack, placing potentially sensitive government documents and associated personal information at risk of public release.

What Public Reporting Shows

Public reporting indicates that the Babuk Locker 2.0 variant claimed responsibility for the incident. The data consists of internal files exfiltrated from the parliament’s systems. No exact victim count has been disclosed, and the precise volume or specific categories of records remain unclear from available information. The listing appeared on the group’s onion-based leak site, which is tracked by ransomware monitoring platforms such as ransomware.live.

Why This Matters for You and Your Family

When government institutions suffer breaches, the ripple effects reach ordinary citizens. Parliamentary databases often contain correspondence, constituent records, employee details, and contractor information that can include names, addresses, phone numbers, and email accounts linked to everyday people. If your information appears in any of those files, it can be combined with data from previous breaches to build a detailed profile. Credential leaks like this one frequently cascade into account takeovers on personal email, banking, and social media. For families, the exposure can extend to children whose school or activity records sometimes find their way into government-adjacent systems.

The Doxxing and Identity-Chain Implications

Attackers rarely stop at the first dataset. Once internal files surface, opportunistic actors scan them for email addresses, usernames, and phone numbers, then cross-reference those details across dozens of other breaches. This creates an identity chain that links your online handles to your real name, home address, and family members. Gaming accounts are especially vulnerable because children and teens often reuse passwords or email addresses tied to family domains. A single leaked credential from a parliamentary file can lead to doxxing attempts, harassment, or financial fraud that starts with a seemingly unrelated government breach.

Babuk2’s Publicly Known Track Record

Public reporting attributes the current activity to the Babuk2 ransomware group, widely viewed as a successor or rebrand of the original Babuk operation. The group first gained attention in 2021 and has targeted hospitals, manufacturers, and public-sector organizations. Its typical playbook involves gaining initial access through phishing or exploited vulnerabilities, exfiltrating sensitive files before encryption, and then publishing samples on a leak site if the victim refuses to pay. Extortion demands usually carry strict deadlines measured in days, after which additional data is released in batches. The exact name Babuk2 allows interested readers to follow dedicated trackers for future activity.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the parliament.iq breach.
• Rotate any password you used on parliament.iq or any Iraqi government site and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is flagged within hours instead of months.
• Cover the entire household with DoxxScan family protection, which includes children’s gaming accounts that often reuse credentials and become entry points for doxxing chains.
• Let remediation specialists handle takedown requests for any exposed personal records that appear on data broker sites or underground forums.

The parliament.iq breach is a reminder that government systems hold pieces of ordinary citizens’ lives, and those pieces are increasingly valuable to ransomware operators. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with this incident. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists who also cover your family and children’s gaming accounts.