rac.gov.my Listed by babuk2 Ransomware Group

On March 19, 2025, the Malaysian government website rac.gov.my appeared on the leak site of the Babuk2 ransomware group, with attackers claiming to have exfiltrated internal files during a ransomware incident.

What's Publicly Reported from Reporting

Public reporting indicates the incident involved a ransomware attack on the Road Transport Department of Malaysia, which operates rac.gov.my. The Babuk2 group posted evidence of the breach on their leak site hosted on the dark web. Available details show that internal files were taken, though the exact volume and complete list of contents have not been fully disclosed in open sources. No confirmed victim count for individuals has been released, and the precise date of initial compromise remains unclear from current public information. The listing follows the group’s typical pattern of publishing samples after victims do not meet their demands.

Why This Matters for You and Your Family

When a government service like rac.gov.my is breached, the information inside can include personal records that connect your driving licence, vehicle registration, address, and contact details. If you or any member of your family holds a Malaysian driving licence, owns a registered vehicle, or has interacted with the Road Transport Department, your data may now sit in attackers’ hands. Internal files often contain spreadsheets or databases that link names, identification numbers, and addresses, making it easier for criminals to target you with identity theft, phishing, or physical threats. Families feel this directly because one exposed record can lead to repeated scam calls, loan fraud in your name, or unwanted attention at your home address.

The Doxxing and Identity-Chain Risks

Stolen government records rarely stay isolated. Attackers combine them with data from earlier breaches to build detailed profiles. A phone number from rac.gov.my can be matched to your email, social-media handles, and children’s online accounts. This creates an identity chain that turns a single leak into long-term harassment or doxxing. Credential leaks of this kind frequently cascade into gaming account takeovers, where attackers use the same passwords or recovery details to seize control of accounts belonging to you or your children. Once they hold those accounts they can demand ransom, spread private information, or use them as stepping stones to further targets.

Babuk2’s Publicly Known Track Record

Public reporting attributes the Babuk2 ransomware group as a rebrand or successor to earlier Babuk operations that first gained attention around 2021. The group has listed hospitals, manufacturers, and local government agencies among its prior victims. Their typical playbook begins with gaining initial access through phishing or exploited vulnerabilities, followed by exfiltration of sensitive files before deploying ransomware. If payment is not received, they publish samples on their leak site and sometimes offer the full dataset for sale. In this case they followed that pattern by listing rac.gov.my after an apparent failure to secure ransom.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, government IDs, and online handles across 13.1 billion+ breach records and more than 100 platforms.
• Rotate any password you have ever used on rac.gov.my or related Malaysian government services, then enable two-factor authentication through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring so the next breach exposing your family is caught and addressed within hours rather than months.
• Cover the entire household with DoxxScan family protection, which includes dependents and children’s gaming accounts that often chain back to the same addresses and recovery details.
• Let remediation specialists handle takedown requests and broker removals for any exposed personal records uncovered during the process.

The rac.gov.my breach is a reminder that government systems many families rely on remain attractive targets, and the data they hold can fuel identity chains for years. Starting with clear steps now limits how far attackers can travel with your information. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and 100-plus platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Source: babuk2 leak site via ransomware.live