Ministry of Health Rwanda listed by the Babuk2 ransomware group

Overview

The Babuk2 ransomware group has listed the Ministry of Health of Rwanda (moh.gov.rw) on its leak site. The listing appeared on 31 March 2025. The ministry's leak page was not reachable at the time of analysis.

What was published

The group claims to have exfiltrated data from the ministry. The archive is expected to include health programme records, administrative documentation and employee information.

Risks for affected individuals

• Public health records may be exposed.
• Administrative data could be misused.
• Employees' information may be included.

What remains unknown

• The volume of data exfiltrated.
• The exact contents of the leak.
• Whether the data has been published elsewhere.

What affected people should do

The ministry should coordinate with Rwandan cybersecurity authorities, review affected systems, and inform staff and partners. Public servants should be alert to phishing referencing the ministry.