Indah Water Konsortium listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Malaysia
• Sector: Government & Defense
• Announcement date: November 7, 2023

Rhysida claims attack on Indah Water Konsortium

The Rhysida ransomware group has listed Indah Water Konsortium on its dedicated leak site. According to the announcement made on November 7, 2023, the threat actor group claims to have targeted the Malaysian organization, alleging that they have successfully exfiltrated a significant amount of data. The group's announcement suggests that they are employing double-extortion tactics against the entity.

Double extortion is a common tactic used by modern ransomware groups. In this method, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information before the encryption process begins. The attackers then threaten to leak this stolen data on public forums or leak sites if the ransom is not paid. This approach increases the pressure on the victim, as the threat of a data breach can lead to regulatory penalties, loss of reputation, and legal consequences, even if the organization can restore its systems from backups.

Details of the claimed data breach

The Rhysida group has provided specific metrics regarding the scale of the alleged data theft. According to the group's claims, the dataset consists of a large volume of information that they intend to make available for access. The specific details provided by the group regarding the stolen information are as follows:

• Total claimed data size: 448 GB
• Total claimed file count: 330,772 files

Regarding the specific nature of the files, the announcement does not provide any specific details regarding the content of the shared data, offering only a general reference to documents. No specific information was provided concerning the exact types of files or the specific sensitive information contained within the 330,772 files mentioned by the group.

About Indah Water Konsortium

Indah Water Konsortium is the national sewerage company of Malaysia. The organization is owned by the Minister of Finance Incorporated. It holds the responsibility for the development and maintenance of a modern and efficient sewerage system throughout the country of Malaysia.

Potential risks and implications

This situation may bring a risk of exposure for the organization's operational data and sensitive information. Given that the Rhysida group emerged in 2023 and is known to target public institutions, a threat profile that could lead to disruptions in the organization's critical infrastructure services may be observed. The targeting of national utility and sewerage services highlights the vulnerability of critical infrastructure to cyberattacks.

If the leak is confirmed, legal processes under Malaysia's data protection regulations could be triggered. Furthermore, the publication of such data may create secondary risks for employees and stakeholders, such as identity theft or targeted phishing attacks. When sensitive organizational data is leaked, attackers often use the information to conduct highly convincing social engineering campaigns against employees or customers.

For organizations operating within the government and public utility sectors, maintaining robust defensive postures is essential. This typically involves implementing multi-factor authentication, maintaining rigorous patch management schedules, and ensuring that network segmentation is used to protect critical infrastructure from lateral movement. Additionally, organizations often focus on continuous monitoring and incident response planning to mitigate the impact of such potential threats.