Ransomware Group: CLOAK

VICTIM NAME: Pensions[.]gov[.]lk

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the CLOAK Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page concerns the public sector domain of pensions.gov.lk, which is associated with the national pension services of Sri Lanka. The breach was discovered and publicly reported on June 27, 2025. Specific details about the nature of the compromise, including the type of data leaked or the extent of the breach, are not explicitly provided on the page. The page indicates that the attack was conducted by a group known as “cloak,” but no further technical information or evidence is available regarding the methods used.

The leak appears to include potentially sensitive information related to pension and government activities, although no explicit PII or personal data is disclosed here. The page contains no images, screenshots, or download links, and there is no evidence of data exfiltration specifics or leaked documents visible from the available information. The incident involved the government’s pension services in Sri Lanka, which plays a critical role in managing citizen pensions and social security programs. The breach highlights the ongoing cybersecurity vulnerabilities within government infrastructure and the importance of robust security measures to prevent data compromises in the public sector.