Pensions.gov.lk Listed by Cloak Ransomware Group

On June 27, 2025, the official website of Sri Lanka’s Department of Pensions was listed on the leak site of the cloak ransomware group, with attackers claiming to have exfiltrated internal files during a ransomware incident.

What Public Reporting Shows

Public reporting indicates the incident targeted pensions.gov.lk. The cloak group posted details of the breach on its leak site, stating that internal files had been taken. The exact number of people affected remains unknown, and the specific types of records exposed have not been independently verified. No ransom demand deadline has been publicly confirmed in available reporting.

The listing appeared on a monitored ransomware tracking platform, which aggregates data directly from attacker-controlled leak sites. Industry research from sources such as DoxxScan™ continuous monitoring has previously shown that government and public-sector systems frequently appear in such incidents, though this specific breach has not yet been added to public breach databases.

Why This Matters for You and Your Family

When a government pensions portal is breached, the people most likely to be exposed are ordinary citizens who have interacted with the system — retirees, current government employees, and their families. Pension records often contain names, national identification numbers, addresses, bank details, and employment history. Once this information leaves official servers, it can circulate on underground forums for years.

Any family member whose pension, salary, or benefit data was stored on pensions.gov.lk could face increased risk of identity theft, fraudulent loan applications, or targeted scams. Children and dependents listed on family benefit claims may also be pulled into the exposed dataset, creating long-term privacy problems that surface later in life.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one database. A single exposed email, phone number, or national ID can be combined with information from earlier breaches to build a complete profile. Attackers and data brokers routinely link gaming usernames, social-media handles, and family addresses into chains that lead directly to individuals and their households.

Credential leaks like this one often cascade into account takeovers on personal email, banking, and gaming platforms. Children’s gaming accounts are especially vulnerable because they frequently reuse passwords or recovery emails tied to a parent’s breached government record. Once an attacker controls one account in the chain, they can reset others and escalate to full doxxing.

Cloak Ransomware Group’s Track Record

Public reporting attributes the cloak group with emerging in late 2024. The gang has targeted organizations across multiple countries, focusing on government agencies, healthcare providers, and educational institutions. Notable prior victims listed on ransomware tracking sites include municipal governments and public utilities, though exact details vary by incident.

The group’s typical playbook involves gaining initial access through phishing or unpatched remote desktop services, exfiltrating data before deploying ransomware, and then publishing samples on their leak site if the victim does not pay. Extortion pressure is applied through direct contact and public shaming on the dark web. As with most ransomware operators, certainty about every past incident remains limited, and reporting relies on the group’s own claims.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, government IDs, and online handles so you can see the full exposure chain created by this claimed breach.
• Rotate any password you ever used on pensions.gov.lk — or any government portal — wherever it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught and acted on within hours rather than months.
• Cover the entire household with DoxxScan family protection, which includes dependents and children’s gaming accounts that can be reached through the same leaked address or recovery details.
• Let DoxxScan remediation specialists manage takedown requests for any personal information already appearing on data broker sites linked to this incident.

The pensions.gov.lk breach is a reminder that government systems holding your retirement and benefit records are high-value targets. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with this leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts. Start your DoxxScan trial today to close the gaps this incident has opened.