Perdana Petroleum Berhad targeted by direwolf ransomware group

• Ransomware group: direwolf
• Country: Malaysia
• Sector: Energy & Utilities
• Announcement date: January 13, 2026

The direwolf group claims a data breach at Perdana Petroleum Berhad

The threat actor known as direwolf has listed data allegedly belonging to Perdana Petroleum Berhad on their dedicated leak site. According to the announcement, the group claims to have successfully exfiltrated a significant volume of information from the organization's systems.

This incident follows a common pattern observed in modern cyberattacks, specifically the double extortion tactic. In such scenarios, ransomware groups do not merely encrypt an organization's files to disrupt operations; they also focus on stealing sensitive data. The threat of leaking this stolen information on public platforms is used as leverage to pressure the victim into paying a ransom. While the presence of a listing on a leak site is a serious indicator of a potential compromise, it is important to note that these claims are made by the threat group itself.

Details of the alleged event

On January 13, 2026, the direwolf group published a leak announcement specifically targeting Perdana Petroleum Berhad. The group claims to possess 150 GB of data that was purportedly obtained from the organization's internal systems. The announcement was made active on the group's leak platform on the same day, January 13, 2026.

Regarding the specific contents of the breach, there is no detailed information available concerning the nature of the allegedly leaked data. The provided screenshots associated with the leak do not contain specific descriptions of the data types that have been targeted. Consequently, the listing names no specific data types.

About Perdana Petroleum Berhad

Perdana Petroleum Berhad is a Malaysia-based company that provides offshore support vessels to the oil and gas industry. The company specializes in offering marine services to support drilling and production operations.

Potential impacts and industry implications

This alleged data breach may create negative impacts on the organization's operational continuity and corporate reputation. Depending on the actual content of the leaked data, secondary risks such as identity theft and targeted phishing attacks may be observed if employee or customer information is exposed. The energy sector may be more significantly affected due to the nature of critical infrastructure, potentially leading to scrutiny from regulatory bodies.

Information about the direwolf group remains limited, making it difficult to determine their full scope of operations or specific motivations. Organizations operating within critical infrastructure sectors often face heightened risks from such actors. To mitigate these risks, companies typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining rigorous patch management, and conducting regular employee security awareness training to prevent initial access.

Furthermore, the organization may need to take necessary precautions within the framework of data breach notification obligations and local regulations. In the event of a confirmed breach, organizations generally follow established incident response protocols to contain the threat, investigate the extent of the exposure, and fulfill legal requirements regarding the notification of affected parties and relevant authorities.