Garuda Indonesia listed on Mallox ransomware leak site

• Ransomware group: mallox
• Country: Indonesia
• Sector: Transportation
• Announcement date: July 9, 2023

Mallox ransomware group claims data breach at Garuda Indonesia

The threat actor known as Mallox has officially listed the Indonesian flag carrier, Garuda Indonesia, on its dedicated leak site. This announcement, made on July 9, 2023, serves as a claim by the group that they have successfully compromised data belonging to the organization. At this stage, the incident remains a claim made by the threat actor via their public leak site.

Details of the alleged attack

According to the announcement made by the Mallox group, the organization's data has been compromised. The group utilized its leak site to publicize this incident on July 9, 2023, coinciding with the date they claim the attack occurred. Information regarding the specific identity and operational details of the Mallox group remains limited in the public domain, making it difficult to establish a comprehensive profile of the actor's typical tactics beyond this specific listing.

Regarding the specifics of the breach, there is no information provided regarding the nature of the leaked or threatened data. The listing does not specify the types of files involved, nor does it provide any screenshots to substantiate the claim of a successful intrusion. Furthermore, there is no information available concerning the total volume of data stolen or the specific number of files that may have been exfiltrated during the alleged operation.

The organization involved

Garuda Indonesia is the flag carrier airline of Indonesia. The company provides a wide range of transportation services, including both passenger and cargo transportation, operating across various international and domestic routes.

Potential risks and industry implications

The claim that the organization's data has been leaked poses several secondary risks. If the breach is substantiated, it could lead to identity theft or the execution of targeted phishing attacks aimed at the organization's employees and customers. In the aviation and transportation sector, the potential compromise of sensitive passenger or operational data could trigger significant legal processes and regulatory scrutiny.

Such an incident can lead to substantial reputational damage and may cause disruptions to the organization's operational processes. If the threat actor employs a double extortion method—a common ransomware tactic where attackers both encrypt data and threaten to leak it—the risks regarding the publication or sale of the data may persist for an extended period.

In general, organizations facing such threats often prioritize defensive measures such as implementing multi-factor authentication, maintaining robust offline backups, and conducting regular security awareness training to mitigate the impact of phishing. For companies in the transportation sector, maintaining the integrity of operational data is critical to preventing service disruptions and ensuring passenger safety and trust.