ikhasas.com listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Malaysia
• Announcement date: October 5, 2026

ikhasas.com targeted by safepay ransomware group

The Malaysian-based holding company ikhasas.com has been listed on the leak site of the ransomware group known as safepay. According to an announcement published by the group on October 5, 2026, the organization has been targeted in a cyberattack. The listing suggests that the group may have gained unauthorized access to the organization's digital infrastructure.

Details of the claimed attack

The safepay group published an announcement on its leak site on October 5, 2026, claiming to have compromised the systems of ikhasas.com. As part of its extortion attempt, the group provided specific details regarding the company's operational background and business activities. This method is a common tactic used by ransomware actors to pressure victims into meeting ransom demands by demonstrating that they possess knowledge of the target's internal operations.

In many ransomware scenarios, groups utilize these public listings to increase psychological pressure on the victim. By showcasing the name of the company and its operational details, the threat actors aim to damage the reputation of the organization and create urgency. This specific incident involves a claim of compromise that was announced on the same day the group alleges the attack occurred.

Data involved in the incident

The specific nature of the data allegedly compromised is not disclosed in the announcement. The listing names no specific data types.

About ikhasas.com

iKHASAS is a Malaysia-based holding company established in 2008. The organization operates across a diverse range of sectors, including construction, property development, hospitality, and plantation. Given its broad operational footprint, the company maintains significant digital and physical assets across multiple industries.

Analysis and potential implications

The use of double extortion tactics by the safepay group may increase the risk of sensitive data exposure for the organization. Double extortion is a strategy where attackers not only encrypt an organization's data to disrupt operations but also threaten to leak stolen information on public forums if a ransom is not paid. This approach significantly raises the stakes for the victim, as the threat shifts from mere operational downtime to a permanent loss of confidentiality and potential regulatory consequences.

Given the company's involvement in construction and infrastructure projects, a data breach could potentially impact trade secrets and supply chain security. In sectors that manage large-scale physical developments and complex logistics, the theft of proprietary project plans, contractor information, or strategic business intelligence can have long-term repercussions for competitive advantages and partner trust.

Furthermore, the organization may face regulatory scrutiny under Malaysia's Personal Data Protection Act (PDPA). When organizations handle personal information, they are subject to legal frameworks designed to protect individual privacy, and a breach can trigger mandatory reporting requirements and potential legal penalties. Additionally, it is possible that any leaked information could be utilized for targeted phishing campaigns against employees or business partners, using the stolen context to craft highly convincing social engineering attacks.

To mitigate such risks, organizations in complex sectors often implement multi-layered defense strategies. This typically includes robust access controls, continuous monitoring of network traffic for unusual activity, and comprehensive employee training to recognize phishing attempts. Maintaining a rigorous incident response plan and ensuring regular, offline backups of critical data are also standard defensive measures used to reduce the impact of ransomware and extortion attempts.