krybit ransomware group lists orex.co.th on its leak site

• Ransomware group: krybit
• Country: Thailand
• Announcement date: September 1, 2026

Krybit claims to have stolen data from Orex Trading Co., Ltd.

The ransomware group known as krybit has listed the Thailand-based organization Orex Trading Co., Ltd. on its leak site. The announcement, which appeared on September 1, 2026, indicates a significant data breach involving the medical distributor. According to the claims made by the threat actor, the attack occurred on the same day the listing was posted.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, attackers do not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive data. The threat actors then threaten to leak this stolen information on public forums or dedicated leak sites if a ransom is not paid. This method places immense pressure on organizations due to the potential for reputational damage and regulatory scrutiny.

The listing by krybit follows a pattern seen in modern cybercrime, where leak sites serve as a public stage for extortion. These sites are used by various ransomware groups to host stolen data, providing a sense of legitimacy to their claims and increasing the pressure on the victimized company to comply with their demands.

Details of the claimed data leak

The group krybit has provided specific details regarding the scale of the alleged breach. The announcement states that the total size of the data claimed to belong to orex.co.th is 194.49 GB. While the volume of the data is specified, the group has not provided any specific details regarding the content of the leaked data.

The listing names no specific data types or file categories that have been compromised. The absence of specific information regarding the nature of the files makes it difficult to determine the exact contents of the 194.49 GB of data at this stage. The group's announcement included details regarding the company's operations and contact information, but no further specifics on the stolen files were provided.

About Orex Trading Co., Ltd.

Orex Trading Co., Ltd. is a Thailand-based distributor of medical products and pharmaceuticals. The company provides supply and distribution services for various medical equipment and pharmaceutical products to the healthcare sector. As a key player in the medical supply chain, the organization plays a role in providing essential equipment and medications to various healthcare providers.

Potential risks and sectoral implications

This incident indicates that the organization's operational data and sensitive commercial information may be at risk of exposure. Because the company operates in the medical product distribution sector, the leaked data could potentially contain customer information or supply chain records. Such a breach can create significant secondary risks for the company's business partners and customers, including the possibility of identity theft or targeted phishing attacks.

Furthermore, the organization may face legal sanctions under Thailand's local data protection regulations. When sensitive commercial or personal data is compromised, organizations often face investigations by regulatory bodies to ensure compliance with national privacy laws. The potential for legal and regulatory consequences adds another layer of complexity to the aftermath of such a breach.

To mitigate risks associated with such attacks, organizations in the medical and pharmaceutical distribution sectors often implement various defensive measures. These include robust encryption for data at rest and in transit, multi-factor authentication (MFA) across all systems, and regular security awareness training for employees to prevent phishing. Additionally, maintaining comprehensive, offline backups and implementing strict network segmentation can help limit the movement of attackers within a network and ensure business continuity during an incident.

Public information regarding the krybit group remains limited, making it difficult to attribute the attack to a specific known entity or to predict future movements by this group.