www.merchant.id Listed by Babuk2 Ransomware Group
If you are a customer of merchant.id, here’s what is being claimed, and what it would mean for you.
merchant.id was listed on Babuk2's leak site. Babuk2 claims to have stolen internal data. This is the group's claim, not a confirmed finding.
On January 27, 2025, the Indonesian e-commerce platform www.merchant.id appeared on the leak site of the Babuk2 ransomware group, with attackers claiming to have exfiltrated internal files during a ransomware incident.
Watch merchant.id
Get alerted the next time merchant.id files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about merchant.id’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates that the Babuk2 group posted details of the www.merchant.id breach on their leak site. The listing states that internal files were taken during a ransomware attack, though the exact volume and specific types of data remain unclear from available information. No confirmed victim count has been released by the company or the attackers. The incident follows the typical ransomware pattern of encryption followed by data exfiltration and extortion pressure.
Available reporting describes the primary source as the Babuk2 leak site itself, mirrored and tracked by ransomware.live. As of the publication date, the company had not issued a public statement confirming or denying the claims.
Why This Matters for You and Your Family
When a service like www.merchant.id that handles online transactions suffers a breach, your personal and financial details can quickly end up in the hands of criminals. Even if you are not a direct customer, shared credentials across websites mean one leak can open the door to your email, banking, or shopping accounts.
- Every indexed leak tied to your address — all of them, named and dated
- A deeper search of collected breach data — the kinds of your information it holds, where it finds you
- What this kind of incident typically exposes
- A ten-minute lock list written for this kind of organisation
Internal files often contain names, addresses, phone numbers, payment records, and employee information. For families, this can expose both parents and children if shared accounts or family email addresses were used. Once criminals have this data, they can attempt account takeovers, file fraudulent tax returns, or sell the information on underground markets.
The Doxxing and Identity-Chain Risks
A single breach rarely stays isolated. Criminals use leaked emails, usernames, and phone numbers to map connections between your online handles and real-world identity. This process, known as identity chaining, can link your shopping account to social media profiles, children’s gaming accounts, and home address details.
Credential leaks like this one frequently cascade into gaming account takeovers, especially for children who reuse usernames or email addresses. Once attackers control a gaming profile tied to your family’s address or payment methods, they can launch further doxxing attacks or demand ransom. The speed at which these chains grow makes early detection essential.
Babuk2 Group’s Known Track Record
Public reporting attributes the Babuk2 operation to a successor or rebranded version of the original Babuk ransomware group, which first emerged around 2021. The group has targeted organizations across multiple countries, with prior victims including healthcare providers, manufacturers, and technology companies. Their typical playbook involves gaining initial access through phishing or exploited vulnerabilities, deploying ransomware to encrypt systems, exfiltrating sensitive files, and then publishing samples on their leak site if the victim refuses to pay.
The group’s extortion style combines technical encryption with public shaming, often giving victims a short deadline before releasing more data. While exact tactics can evolve, the pattern of listing companies like www.merchant.id on dark web leak sites has become their standard public pressure method.
What to do
- Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what this claimed breach may have exposed.
- Rotate any password you used on www.merchant.id or similar merchant services, and enable 2FA through an authenticator app rather than SMS.
- Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
- Cover the household with DoxxScan family coverage that includes dependents and your children’s gaming accounts, which often chain back to the same addresses and emails.
- Let remediation specialists handle takedown requests for any exposed personal records found on data broker sites.
The most effective defense is treating every breach as the start of a potential chain that can reach your family. Starting with a clear map of your digital footprint allows you to close gaps before criminals exploit them. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly includes children’s gaming accounts vulnerable to credential-based takeovers.
What the free scan actually returns
Found on people-search siteswe remove these
These listings are live, public, and legal to remove — and removing them is what we do.
Found in breach recordsverifiedreported — unverified
Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.
Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.
