Workers.com.zm listed by the Babuk2 ransomware group

Overview

The Babuk2 ransomware group has listed Workers.com.zm, a Zambian employment portal, on its leak site. The listing appeared on 27 January 2025. At the time of analysis, the group's leak page was not reachable.

What was published

The group claims to have exfiltrated data from the portal. Employment portals hold user profiles, CVs and contact data, which are the likely contents of the exfiltration.

Risks for affected individuals

• Job seekers' personal data may be exposed.
• User records could enable fraud.
• Employers' information may be included.

What remains unknown

• The volume of data exfiltrated.
• The exact contents of the leak.
• Whether the data has been published elsewhere.

What affected people should do

Users should change passwords and be alert to phishing referencing the portal. Workers.com.zm should notify affected users, secure its systems, and coordinate with Zambian authorities.