Sunway Berhad listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Malaysia
• Sector: Hospitality
• Announcement date: July 23, 2026

Qilin ransomware group claims data breach against Sunway Berhad

The Qilin ransomware group has listed the Malaysian conglomerate Sunway Berhad on its dedicated leak site. The threat actor group is alleging that a data breach has occurred, targeting the organization's digital infrastructure. This announcement was made on July 23, 2026, marking a significant development in the ongoing threat landscape facing large-scale enterprises in the region.

Details of the claimed attack

According to the announcement posted on the group's leak portal, the threat actor known as Qilin listed Sunway Berhad on July 23, 2026. The group claims to have successfully compromised data belonging to the organization. This specific type of listing indicates that the group is employing double-extortion tactics against the entity.

Double-extortion is a common tactic used by modern ransomware groups. In this method, attackers do not just encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The attackers then threaten to leak the stolen data on public forums or specialized leak sites if the ransom is not paid. This adds a layer of pressure on the victim, as the threat of public exposure and regulatory scrutiny serves as additional leverage for the criminals.

Information regarding the leaked data

At this stage, there is no information provided regarding the nature of the leaked or threatened data. While the group's announcement includes a screenshot displaying the organization's logo, no specific details about the content of the data are available. The listing names no specific data types.

About Sunway Berhad

Sunway Berhad is a Malaysia-based conglomerate operating in various sectors including property development, construction, hospitality, retail, and healthcare. The company is particularly known for its integrated township projects and sustainable urban development initiatives.

Analysis and implications for the sector

The Qilin group is known as a Ransomware-as-a-Service (RaaS) operation active since 2022, typically employing double-extortion tactics. This suggests that the organization may face the risk of having sensitive data exposed publicly. Given that the entity is based in Malaysia, legal proceedings under local data protection regulations may be initiated following such an incident.

Furthermore, there is a possibility that the leaked data could be leveraged for identity theft or targeted phishing campaigns. The group's past activities indicate that they may target various sectors, including hospitality and healthcare, which often handle large volumes of sensitive personal and corporate information.

For organizations operating in these sectors, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular employee training to recognize phishing attempts. Because ransomware groups often target high-value sectors, continuous monitoring and rapid incident response capabilities are vital to mitigating the impact of potential breaches.