Who does the Booba Project ransomware group target?

According to Mallory's profile of the group, its reported victims are concentrated in the United States, though other victims have been identified outside the country, including a company in Switzerland.

What is double extortion and how does the Booba Project use it?

The group steals data and applies pressure in two ways: operational pressure through encryption that may prevent victims from working normally, and exposure pressure by listing the victim on a leak site and threatening to release stolen files unless a ransom is paid.

Why don't backups fully solve a Booba Project attack?

Backups can bring systems back online, but they cannot un-steal data that has already been taken and threatened with publication on the leak site.

Which Swiss company did the Booba Project claim as a victim?

The group claimed against Zynex, a Switzerland-based company, saying it stole roughly 1.4 GB of data.

Can leak-site claims about stolen data be trusted?

No—leak-site entries are made by criminals and the amounts of data they claim to hold are not independently verified by default, so they should be treated as signals to investigate rather than as proof.

Booba Project Ransomware Group: US Targets, Swiss Victim

The Booba Project ransomware group is a financially motivated extortion operation that lists victims on a leak site and threatens to publish stolen information unless a ransom is paid. Public information about the group is limited, but the outline is clear enough to be useful: its reported targets are concentrated in the United States, with additional victims identified elsewhere, including a company in Switzerland.

This post explains what is known, how the extortion model works, and what ordinary people and small businesses can do to reduce the damage if their data ends up in the wrong hands.

Who the Booba Project Targets

According to the profile of the group published by the threat intelligence platform Mallory, the Booba Project's reported victims are concentrated in the United States. Other victims have been identified outside the country, which shows the group is not strictly limited to one market.

The source material does not give a detailed breakdown of industries, victim counts, or the technical methods the group uses to break in, and it would be a mistake to fill those gaps with guesswork. What can be said is that the group fits a familiar pattern: it is motivated by money, not politics, and it picks organizations that hold data valuable enough to pressure them into paying.

For readers, the practical point is that location does not make an organization safe. A group with a mostly US focus can still reach a business in Europe, as the Swiss case below shows.

How the Leak-Site Extortion Model Works

The Booba Project follows what is commonly called double extortion. Instead of only locking systems, the operators also steal data and then apply pressure in two ways:

Operational pressure: if systems are encrypted, the victim may be unable to work normally.
Exposure pressure: the group publishes the victim's name on a leak site and threatens to release the stolen files unless a ransom is paid.

The leak site is the key tool. A public listing works as both a threat and a deadline. It tells the victim, its customers, and the press that an incident has occurred, even before any files are released. That is why restoring from backups, while essential, does not fully solve the problem. Backups can bring systems back online, but they cannot un-steal data.

The listing itself is also only a claim. Leak-site entries are made by criminals, and the amounts of data they say they hold are not independently verified by default. Treat them as signals to investigate, not as proof.

What the Zynex Claim Shows About the Group's Activity

The group's reach beyond the United States is illustrated by its claim against Zynex, a Switzerland-based company. As covered in our report on the Booba ransomware group's claim against Swiss firm Zynex, the group says it stole roughly 1.4 GB of data.

That figure is the group's own assertion. It is a useful example of how these claims typically appear: a named victim, a stated volume of stolen data, and a threat to publish it.

The case also raises legal questions for companies operating in Switzerland. Since September 1, 2023, businesses there have worked under the revised Federal Act on Data Protection. Our explainer on Swiss Data Protection Act compliance since 2023 covers the framework and is a good starting point for understanding what obligations can follow a data theft.

What This Means For You

Most people will never deal with a ransomware group directly. The more likely scenario is that a company you do business with, such as a service provider, a supplier, or an employer, is listed on a leak site and your information is among the stolen files.

That means your exposure often depends on decisions made by others. You cannot stop the breach, but you can limit what a stolen file can be used for.

Steps Consumers and Small Businesses Can Take to Limit Exposure

For individuals:

Use a unique password for every account, stored in a password manager, so one leaked credential does not unlock others.
Turn on multi-factor authentication wherever it is offered, preferably with an authenticator app or security key.
Be alert to phishing that references a real breach. Criminals often use news of an incident to make scam messages look credible.
Consider a credit freeze if sensitive identifiers such as national ID numbers were involved, and watch statements for unusual activity.

For small businesses:

Keep offline or immutable backups and test restoring them, so encryption alone cannot halt operations.
Collect and keep only the data you need. Data you no longer hold cannot be stolen.
Limit who can access sensitive files, and apply software updates promptly.
Prepare an incident response plan before you need it, including who to call, how to notify customers, and what legal reporting duties apply in your jurisdiction.
Segment networks so one compromised device does not expose everything.

If you are listed on a leak site, involve legal counsel and incident responders quickly. Paying does not guarantee that data will be deleted, and it may fund further attacks.

Key Takeaways

The Booba Project ransomware group is a reminder that modern extortion is as much about stolen data as locked systems. Its reported focus on US organizations, plus at least one Swiss victim, shows that geography offers little protection.

Strong, unique passwords, multi-factor authentication, minimal data retention, and tested backups remain the most effective defenses. To see what a Booba Project claim looks like in practice, read our coverage of the Zynex claim, and for the legal side of a breach, see our guide to Swiss data protection compliance.