YPC Malaysia listed on Direwolf ransomware leak site

• Ransomware group: Direwolf
• Country: Malaysia
• Sector: Manufacturing
• Announcement date: November 13, 2025

Direwolf claims data breach at YPC Malaysia

The threat actor known as Direwolf has officially listed the Malaysian manufacturing firm YPC Malaysia on its dedicated leak site. According to the announcement made on November 13, 2025, the group claims to have successfully infiltrated the organization's systems and exfiltrated a significant volume of sensitive information.

The group asserts that they have acquired 66 GB of data from the target. The timeline provided by the threat actor suggests a planned escalation of the leak. The announcement states that sample files are scheduled to be released on November 15, 2025. If the group follows through with its stated schedule, the full dataset is intended to be published on the leak site on November 30, 2025.

Details of the alleged data theft

The information provided by the Direwolf group indicates that the breach involves a wide range of sensitive corporate and administrative documentation. The threat actor claims that the compromised files include critical business assets and private records. Specifically, the group claims to have obtained the following types of data:

• Design drawings
• Financial documents
• Customer information
• Accounting records
• Employment contracts
• Audit files

While the specific file count was not provided in the announcement, the sheer volume of 66 GB suggests a substantial breach of the organization's digital infrastructure. The nature of the stolen files indicates that the breach spans multiple departments, from design and engineering to human resources and finance.

About YPC Malaysia

YPC Malaysia is a manufacturing company that specializes in the production of plastic parts and plastic injection molding. The organization plays a role in the supply chain for several major industrial sectors, as it manufactures plastic components specifically for the automotive, electrical, and electronics industries.

Impact and potential risks

This incident may create negative impacts on the organization's operational continuity and commercial reputation. The alleged compromise of customer information and financial records could lead to secondary risks such as identity theft or targeted phishing attacks for the organization's clients. Furthermore, the organization may face legal responsibilities and potential administrative sanctions under Malaysian data protection regulations.

The methods employed by this group suggest they may be aiming to exert double extortion pressure through the disclosure of the organization's sensitive data. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release if a ransom is not paid.

In such scenarios, organizations often face significant pressure to mitigate the fallout of a data leak. While public information about the Direwolf group remains limited, the pattern of their activity is consistent with modern ransomware operations that prioritize data exposure to maximize leverage. Organizations in the manufacturing sector often face these types of threats due to the high value of their intellectual property and supply chain data.