ock.com.my listed on Lockbit5 ransomware leak site

• Ransomware group: Lockbit5
• Country: Malaysia
• Announcement date: October 17, 2026

Lockbit5 claims breach of ock.com.my

The Malaysian-based telecommunications service provider ock.com.my has been listed on the leak site of the LockBit5 ransomware group. According to the announcement made on the group's platform, the organization has been targeted in a cyberattack that may impact its operations and data privacy.

The group claims to have gained access to the organization's networks on October 16, 2026. This claim was subsequently posted to the group's leak site on October 17, 2026. LockBit is a ransomware group that has been active since 2019 and is reported to have returned with a new version following infrastructure disruptions in February 2024.

Details regarding the alleged data leak

At this stage, the group has provided very limited information regarding the specifics of the incident. No details regarding the nature of the allegedly leaked data have been shared by the threat actors. Furthermore, the announcement does not specify the volume of data involved or the number of files that may have been exfiltrated. The listing does not include a ransom demand.

The only media associated with the listing is an image that belongs solely to a monitoring platform, rather than a sample of the organization's internal data. The listing names no specific data types that have been compromised.

About ock.com.my

OCK Group Berhad is a Malaysia-based telecommunications network services and infrastructure provider. The company offers turnkey solutions in areas such as telecommunication towers, fiber optic networks, and energy solutions.

Risk assessment and potential implications

This incident may pose a risk to the operational continuity of the organization's telecommunications infrastructure and the privacy of customer data. Given the past methods of the LockBit group, it is expected that pressure may be exerted on the organization through a double-extortion strategy. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's data but also steal sensitive information, threatening to leak it publicly unless a ransom is paid. This increases the pressure on the victim to comply with demands.

Until the content of the leaked data is clarified, secondary risks may include targeted phishing attacks and corporate identity theft. When sensitive organizational or customer information is leaked, threat actors often use it to craft highly convincing phishing emails to deceive employees or customers. Identity theft can also occur if personal or corporate credentials are part of the breach.

The organization may face legal obligations under data protection regulations in Malaysia. Organizations in the telecommunications sector, which manage critical infrastructure and vast amounts of consumer data, often face significant regulatory scrutiny following such incidents. To mitigate such risks, organizations typically focus on robust network monitoring, strict access controls, and comprehensive incident response plans to ensure operational continuity and protect sensitive information.