Ransomware Malaysia: 177 Organisations Listed, 16 In October

Ransomware Malaysia figures from the Brandefense ATLAS tracker put 177 Malaysian organisations on ransomware leak sites as of 7 November 2026, ranking the country 24th of 184, with 16 organisations listed in October alone, the heaviest month of the year so far. Those are the groups’ own claims, compiled by a threat-intelligence firm, and not one of them is a confirmation by a company or a regulator. That distinction is the whole subject of this article, because the way these listings work is changing what “we were not hacked” means for a Malaysian SME.

Source: Brandefense ATLAS, ransomware victims in Malaysia, figures as of 7 November 2026. Captured 7 November 2026 from https://atlas.brandefense.io/ransomware-intelligence/countries/malaysia

What the ransomware Malaysia numbers actually count

A leak-site listing works like this: a ransomware group steals data from a target, encrypts what it can, and posts the company’s name on a public site with a deadline and a sample of the stolen files. Payment removes the post; silence publishes it. The listing is the group’s own announcement, made to pressure the victim, and trackers such as Brandefense ATLAS count those announcements by country, group and sector.

Source: Brandefense ATLAS, Malaysia country page, figures as of 7 November 2026. The tracker counts group claims, not company confirmations.

Read the sector column and the picture is not one of exotic targets. Financial services, manufacturing, consulting, transport and hospitality are the ordinary supplier base of the economy. A Malaysian SME is more likely to sit two companies downstream of one of these listings than to be listed itself.

October was the heaviest month of the year

The monthly counts on the same tracker run 12 in December 2025, 10 in January 2026, a quiet stretch through the middle of the year at 3 to 7 a month, then 10 in August, 3 in September and 16 in October. November has two listings so far and the month is young. A single month proves nothing about a trend, and the tracker itself says the listing date is not necessarily the date of the attack, because groups post on their own schedule. What the October figure does show is that Malaysian names are appearing on leak sites in batches, not one at a time.

A listing is a claim, and this region is where one group says it works

One group illustrates the pattern well because a threat-intelligence firm has published the arithmetic about it. Brandefense reported on 3 November 2026 that the Orova ransomware group had listed 17 organisations as victims in tracker posts seen between 12 October and 3 November, and that ten of the seventeen were in Singapore or Malaysia.

Source: Brandefense, 3 November 2026. Captured 7 November 2026 from https://brandefense.io/security-news/orova-ransomware-group-singapore-malaysia/

Brandefense’s own report declines to name the companies. This article takes a different line with the tracker’s data and states it plainly: the full Malaysia list is reproduced below, because a table a reader can re-open shows what a listing is worth better than a count does, and every row carries the group that claimed it and the posting date. The article asserts nothing about any listed organisation beyond the fact that its name appears in the tracker on that date. What survives the caveat is the geography. Whatever Orova is actually doing, its claimed victims cluster in exactly two markets, and Malaysia is one of them.

What ATLAS is, and what its 177 rows contain

The numbers above come from ATLAS, a free and public ransomware tracker run by Brandefense, a commercial threat-intelligence company. Anyone can open it without an account. It compiles the victim announcements that ransomware groups publish on their own leak sites and counts them by country, group, industry and month. It is not a government register, not a police report and not a court record: no regulator, bank or company confirms any row in it. Two lines on the tracker’s own Malaysia page state what it is and what it is not. The first: “Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.” The second: “Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.”

Source: Brandefense ATLAS, victims list filtered to Malaysia, showing 177 victims with duplicate claims merged into one row and figures as of 7 November 2026. Captured 7 November 2026 from https://atlas.brandefense.io/ransomware-intelligence/victims?country=malaysia

On 7 November 2026 we read the whole Malaysia list, all 177 rows across its eight pages, and re-counted it from the rows rather than from the tracker’s own summary. The summary survives the check. Qilin is the most frequent claimant at 28, LockBit 3.0 next at 17, then The Gentlemen 13, DireWolf 10 and RansomHub 6, across 59 distinct claiming groups. Financial services leads the sectors at 18. The row-level count adds two things the summary does not show.

The first: 177 listings are not 177 organisations. 167 distinct domains appear in the rows, three rows carry no domain at all, and 7 domains appear twice. Every one of those doubles is the same organisation claimed by two different groups. PLUS Malaysia Berhad is claimed by Qilin and by The Gentlemen on the same day, 6 February 2026, and Kontena Nasional Berhad by the same two groups on 20 January 2026. The tracker states on the page that it merges duplicate claims into one row, so a name seen twice is two separate claims, not a counting error. What the doubles show is the weakest point of the whole method: where two groups claim the same company on the same date, at least one of the claims is not what it says it is. The second: the list says less than its size suggests. 61 of the 177 rows, about one in three, carry no industry at all, and 145 of the 177, four in five, state no data volume. Most rows are a company name, a claiming group and a date. The oldest posting in the list is Mar 13, 2023 and the newest is Nov 2, 2026.

Source: Brandefense ATLAS, victims list filtered to Malaysia, 177 rows read 7 November 2026 across eight pages. Figures as of 7 November 2026. “Data claimed” is omitted from the table because 145 of the 177 rows state none; the remaining rows claim volumes from 2 GB to 2.3 TB. Every row is a ransomware group’s own claim, not a confirmed breach.

What a leak site changes for a supplier chain

Most ransomware coverage is written as if the reader were the target. For an SME the more probable exposure runs through someone else’s listing. A manufacturer or logistics firm two tiers up the chain may hold a supplier’s purchase orders, delivery schedules, staff contacts and customer details, and when that firm’s data is exfiltrated, the smaller company’s information leaves with it. Nothing in the smaller company’s own security posture stops that, which is why the practical response is to know who holds what.

The January Bank Negara penalty on Bank Rakyat, covered in our report on the Bank Rakyat website incident, makes the same point from the regulatory side: the entity that holds the information answers for it, whoever actually lost control of the server.

Five checks worth running this week

None of these needs a security vendor, and the first one takes an hour of a manager’s time.

• List who holds your data outside the company. Cloud accounting, payroll, e-commerce platforms, logistics providers, agencies. For each, note what they hold and whether your contract says anything about breach notification.
• Check your own domain against leak-site trackers. The ATLAS victim list is searchable, and a monthly look costs nothing. If your name appears, treat it as a possible incident and call counsel before you contact anyone.
• Test one restore, not just the backup. A backup that has never been restored is a hope. Restore one system to a clean machine this quarter and time it.
• Take one backup out of reach. Immutable or offline, unreachable from a logged-in administrator’s desktop. Ransomware looks for mounted drives, and it finds them.
• Decide your notification list in advance. Who tells the customers, who calls the lawyer, who files with the regulator, and in what order. Write it down while nobody is panicking.

What to watch

The November count on the tracker, which will show whether October was a spike or a step. Any company statement confirming one of the claimed listings, which would move the story from claim to incident. And the review ordered by the Cabinet, reported on 7 November, since requirements that come out of it tend to reach SMEs through the procurement terms of banks and GLCs.

Read next: Zero Trust Malaysia: what MACC’s 90,000 daily attacks should change for an SME covers the controls, and Bank Rakyat Hack: the bank and the minister disagree covers the third-party accountability question.

Last updated: 7 November 2026, when the tracker’s Malaysia list was read in full and reproduced in the table above. Every figure and every row is a ransomware group’s own claim as recorded by the tracker on that date, not a confirmed breach.

Sources

• Brandefense ATLAS, Ransomware Attacks In Malaysia: Victims & Groups, figures as of 7 November 2026 (177 organisations, 0.5%, rank 24 of 184, Qilin 28 listings at 15.8%, sector and monthly counts) — atlas.brandefense.io
• Brandefense, Orova Ransomware Claims 17 Victims, Mostly in Singapore and Malaysia, 3 November 2026 (17 distinct victims in tracker posts from 12 October to 3 November 2026, ten in Singapore or Malaysia, seven listed or relayed again on 2 and 3 November, no confirmation from any company) — brandefense.io
• Wikimedia Commons, Padlock 7642, CC BY-SA 4.0 (cover photograph) — commons.wikimedia.org
• Own captures, 7 November 2026: the Brandefense ATLAS Malaysia page and the Brandefense Orova report, cropped to the quoted passages. Read-only.

BD Media is the editorial desk of Big Domain. This article reports counts compiled by a threat-intelligence firm from ransomware groups’ own announcements, as published on 3 and 7 November 2026. It is not security advice for any specific system. It reproduces a public tracker’s rows as they were published on 7 November 2026, attributes every claim to the group that made it, and asserts no breach by any listed organisation.

Related reading

Bank Rakyat Hack: The Bank And The Minister Disagree

7 Nov 2026

Malaysia Q3 2026 GDP Grew 5.3%, Full Data Due 18 November

4 Nov 2026

Malaysia Exports Hit RM1.571 Trillion, MSMEs Still 14.7%

4 Nov 2026