Jesin Group listed on Lamashtu ransomware leak site

• Ransomware group: Lamashtu
• Country: Malaysia
• Announcement date: April 20, 2026

Lamashtu claims data breach against Jesin Group

The Lamashtu ransomware group has listed the Malaysian-based property developer Jesin Group on its leak site. According to the announcement made on April 20, 2026, the threat actor group claims to have successfully exfiltrated a significant amount of sensitive information belonging to the organization.

The group alleges that the breach occurred on the same day the announcement was posted, April 20, 2026. This type of activity is characteristic of modern ransomware operations, often referred to as double extortion, where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage for ransom demands. In such scenarios, the threat actors threaten to publish the stolen information on public leak sites if their demands are not met, causing significant reputational and operational damage to the victim.

Details of the alleged data theft

The Lamashtu group claims to have obtained a massive dataset consisting of 60 GB of information, comprising approximately 130,000 files. The group asserts that the stolen data provides detailed insights into the internal processes and business relationships of Jesin Group. According to the listing, the documentation spans a period from 2018 to 2026, covering various aspects of the company's operations.

Based on screenshots shared by the attackers, the leaked content includes highly sensitive documents such as insurance quotation forms, various construction contracts, and salary information. Furthermore, the samples reportedly include Malaysian identity card (MyKad) samples, which pose a significant risk to individual privacy. The specific categories of data mentioned in the listing include:

• Financial records
• Employee HR data
• Personal identification documents
• Project contracts
• Tax documents

The breadth of this alleged data theft suggests that the attackers may have gained access to core business systems and administrative databases, allowing them to extract years of historical and current operational records.

About Jesin Group

Jesin Group is a prominent property developer based in Northern Malaysia, boasting over 50 years of experience in the industry. The company specializes in several key areas of the real estate sector, including residential and commercial real estate development, construction, and asset management. Given its long-standing presence and involvement in large-scale development projects, the organization maintains a vast network of business partners, employees, and clients.

Potential impact and risks

The alleged exposure of such a wide range of data carries severe implications. For Jesin Group, the disclosure of financial and operational data could lead to the loss of trade secrets, potentially damaging the company's competitive advantage in the real estate market. Furthermore, the presence of employee identification documents and salary information increases the severity of the incident, as it exposes individuals to direct risks.

The breach may result in secondary risks such as identity theft and highly targeted phishing attacks directed at Jesin Group employees and their business partners. Additionally, the organization may face legal sanctions under Malaysia's Personal Data Protection Act (PDPA) due to the exposure of personal and sensitive information. While public information regarding the Lamashtu group remains limited, the sensitivity of the data involved suggests a high-impact event.

To mitigate such risks, organizations in the property and construction sectors often implement defensive measures such as multi-factor authentication, rigorous access controls, and regular security awareness training for employees. Monitoring for unauthorized data exfiltration and maintaining robust backup strategies are also essential components of a modern cybersecurity posture to defend against the evolving tactics of ransomware groups.