Southern Lion Sdn Bhd listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: Malaysia
• Sector: Retail & E-Commerce
• Announcement date: November 24, 2025

Inc Ransom claims data breach at Southern Lion Sdn Bhd

The ransomware group known as Inc Ransom has officially listed the Malaysia-based FMCG company Southern Lion Sdn Bhd on its dedicated leak site. According to the group's announcement, the threat actors claim to have successfully breached the organization's network and exfiltrated various sensitive documents. This development follows a pattern of activity observed in modern cyberattacks where data is used as leverage against the victim.

The threat actor's announcement occurred on November 24, 2025. In the listing, the group asserts that they have gained unauthorized access to the company's internal systems. To support their claims of a successful intrusion and data theft, the group has published several document samples on their platform, intended to demonstrate the validity of their breach.

Details of the alleged data exfiltration

While the specific total volume of stolen data and the exact number of files involved have not been disclosed by the group, the samples provided on the leak site offer insight into the nature of the compromised information. The leaked material appears to include a mix of highly sensitive personal identification and internal corporate documentation.

The samples published by the threat actor include the following types of data:

• Passport copies
• Identification documents
• Financial statements
• Technical drawings

The presence of such diverse data types suggests that the breach may have impacted multiple departments within the organization, ranging from human resources and finance to technical operations.

About Southern Lion Sdn Bhd

Southern Lion Sdn Bhd is a significant player in the fast-moving consumer goods (FMCG) sector within Malaysia. The company operates as a joint venture between Japan's Lion Corporation and Lam Soon (M) Bhd. It specializes in the marketing of various products, particularly focusing on the personal care and household cleaning categories.

Risks and implications of the attack

The tactics employed by Inc Ransom in this instance align with the double-extortion model commonly used by modern ransomware groups. In a double-extortion scheme, attackers do not merely encrypt a company's data to disrupt operations; they also steal sensitive information to threaten its public release. This method is designed to increase the pressure on the victim to pay the ransom, as the threat of a data leak can cause significant reputational and regulatory damage.

The potential impact of this breach is multifaceted. For the individuals whose personal documents, such as passports and identification papers, were allegedly stolen, there is a significant risk of identity theft. Furthermore, because the company operates within Malaysia, it may face scrutiny from local regulatory bodies regarding data protection compliance. The exposure of technical drawings and financial statements also suggests that the company's operational continuity and commercial reputation could be at risk.

From a broader cybersecurity perspective, the leaked data could be utilized by the threat actors in future targeted phishing campaigns, using the stolen information to craft highly convincing social engineering attacks. For organizations operating in the retail and consumer goods sectors, such incidents highlight the importance of robust network security and data protection measures. Defensive strategies typically include implementing multi-factor authentication, maintaining strict access controls, and ensuring regular, offline backups are available to mitigate the impact of encryption-based attacks.