Malaysia Airports Holdings Berhad targeted by Qilin ransomware group

• Ransomware group: Qilin
• Country: Malaysia
• Sector: Transportation
• Announcement date: May 1, 2025

Qilin ransomware group claims breach of Malaysia Airports Holdings Berhad

The Qilin ransomware group has announced a cyberattack against Malaysia Airports Holdings Berhad, claiming to have successfully exfiltrated a significant volume of data from the organization's networks. According to the announcement posted on a leak site on May 1, 2025, the threat actors have released the first part of the stolen information, signaling the commencement of a data leak process.

Details of the alleged cyberattack

The Qilin ransomware group claims that the attack against Malaysia Airports Holdings Berhad took place on March 23, 2025. The threat actors assert that they were able to encrypt the corporate network of the organization. Notably, the group claims that flight control systems were excluded from this encryption process, suggesting that the core operational systems for aviation movements may have remained functional during the incident.

This attack appears to follow a double-extortion strategy. In such scenarios, ransomware groups do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information beforehand. By threatening to release this stolen data on public leak sites, the attackers aim to exert maximum pressure on the victim organization to meet their demands, using the threat of reputational damage and regulatory scrutiny as leverage.

Data involved in the breach

The Qilin group claims to have exfiltrated a total of 2 TB of data from the victim's network. While the volume of the stolen data is substantial, the group has not provided specific details regarding the exact content or the nature of the files contained within this dataset. Furthermore, the screenshot provided by the group to support their claims appears to be blurred, making it impossible to verify the specific types of files or information that were taken.

The listing names no specific data types that were stolen.

Organization profile

Malaysia Airports Holdings Berhad is a government-linked aviation company. It is responsible for the operation and management of both international and domestic airports within Malaysia. The company serves a vital role in the country's infrastructure, overseeing the development, maintenance, and various operational processes required to run the national airport network.

Impact and industry implications

This alleged attack by the Qilin group highlights the significant risks faced by organizations providing critical infrastructure services. When a major aviation entity is targeted, the potential for operational disruption is high, even if specific systems like flight control are reportedly spared. Beyond immediate operational concerns, the exfiltration of large datasets poses secondary risks to the organization's ecosystem. These risks include the potential for identity theft or the execution of highly targeted phishing attacks against employees and business partners using the stolen information.

Furthermore, organizations in this sector may face significant legal and regulatory consequences. Under Malaysian data protection regulations, a breach of this magnitude could lead to various legal obligations and potential administrative sanctions. The use of double-extortion methods is specifically designed to damage an organization's reputation and create intense pressure through the public disclosure of sensitive information.

To defend against such threats, organizations in the transportation and critical infrastructure sectors typically focus on several defensive layers. This includes implementing robust network segmentation to prevent lateral movement by attackers, maintaining rigorous backup protocols that are isolated from the primary network, and employing continuous monitoring to detect unauthorized data exfiltration. Additionally, comprehensive employee training regarding phishing and social engineering remains a fundamental component of a modern cybersecurity posture.