berjaya-air.com Listed by lockbit5 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
berjaya-air.com was listed by the lockbit5 ransomware group on September 17, 2025, after internal files were exfiltrated in a ransomware attack that affected an undisclosed number of people. The occurrence date of the breach is not established; individuals should check whether their information was exposed and take appropriate protective steps.
On 17 September 2025, the domain berjaya-air.com appeared on a listing associated with the lockbit5 ransomware group. The group claims that internal files were taken during a ransomware attack. For anyone who has flown with, worked for, or done business with Berjaya Air, the practical concern is straightforward: personal details, booking records, or internal documents could now sit outside the organisation’s control, even though the number of people affected is unknown and public detail remains limited.
Ransomware listings of this kind do not always mean every customer file has been published, yet they do signal that data left the network under pressure. Until more is confirmed, the safest approach is to treat the claim seriously and review what information an airline of this type typically holds.
Breaking down the breach
Public reporting states that berjaya-air.com was listed by lockbit5 on 17 September 2025. The only data type named is “internal files exfiltrated in a ransomware attack.” No figure has been given for the number of people affected, no precise date of the intrusion itself has been released, and no technical description of how the attackers gained access has been disclosed. The listing itself is a claim by the group; independent confirmation of the full scope has not been provided in the available record.
What is known is therefore narrow: a ransomware actor asserts that it removed internal material from systems linked to the airline’s domain and has publicised that claim on its leak infrastructure. Everything beyond that—volume of data, exact file categories, or whether encryption of production systems also occurred—remains undisclosed.
Inside lockbit5
LockBit is a long-running ransomware-as-a-service operation whose affiliates encrypt networks and threaten to publish stolen data unless a ransom is paid. Successive versions, including the iteration referred to as lockbit5, have continued the same double-extortion model: data is copied out before encryption, then partial samples or full archives are posted on a dedicated leak site if negotiations fail. The group has historically targeted organisations across many sectors, using automated tools, stolen credentials, and vulnerability exploitation to gain footholds. Affiliates operate with relative autonomy, which produces variation in the quality and completeness of any single claim.
Because leak-site postings are controlled by the attackers, they function as pressure tactics rather than audited disclosures. In this case, lockbit5’s listing of berjaya-air.com should be read as an unverified assertion that internal files were taken; it does not by itself prove the full extent of any compromise or the sensitivity of every file involved.
About berjaya-air.com
Berjaya Air is a Malaysian regional airline established in 1989 as part of the broader Berjaya Group. Like most carriers of its size, it operates scheduled and charter flights, maintains passenger reservation systems, handles crew and staff records, and manages commercial relationships with airports, suppliers and travel partners. Its public-facing site and booking channels therefore sit atop databases that routinely contain names, contact details, travel itineraries, payment references and operational documents.
A breach affecting such an organisation is consequential because airlines sit at the intersection of personal identity data, financial transactions and critical operational information. Even limited internal files can include passenger manifests, employee records or commercial contracts whose exposure creates lasting risk for individuals and for the carrier’s ability to operate with public trust.
What was likely exposed
The only category named in the available facts is “internal files exfiltrated in a ransomware attack.” No further breakdown—customer databases, employee directories, financial ledgers or technical schematics—has been published. Organisations of this kind typically hold passenger booking data, loyalty or frequent-flyer information, staff personal files, supplier contracts and internal operational documents. Whether any of those specific classes were among the files taken remains unconfirmed.
Until the airline or independent investigators release a verified inventory, it is accurate only to say that internal material left the network under the circumstances claimed by lockbit5. Speculation about particular data fields would exceed the public record.
What's at stake
For individuals, the concrete risks include identity misuse if names, addresses or identity documents appear in the files, targeted phishing that references real travel history, and potential fraud involving payment or booking references. Employees face similar exposure of payroll, contact or performance data. For the airline itself, the stakes include regulatory scrutiny, possible notification duties under data-protection rules, disruption to booking or operations systems, and erosion of passenger confidence.
None of these outcomes is guaranteed by a leak-site listing alone; they become more or less likely depending on what the internal files actually contained and whether the data is later sold or published. The absence of a confirmed headcount simply means the scale of personal impact cannot yet be measured.
If your data was in this claimed breach
Begin by treating any unexpected communication that references Berjaya Air bookings or personal details with caution; verify it through official channels rather than links or attachments. Change passwords on accounts that reuse credentials associated with airline or travel logins, and enable multi-factor authentication where available. Monitor bank and credit statements for unfamiliar charges linked to travel purchases. If you hold a frequent-flyer or corporate travel account with the carrier, review recent activity and update recovery details.
Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach datasets. Such a scan will not confirm or rule out involvement in this specific incident, but it provides a practical baseline for further monitoring while official details remain limited.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
zszeleznice.cz Listed by lockbit5 Ransomware Grouptealca.com Listed by lockbit5 Ransomware Groupjobberswarehouse.com Listed by lockbit5 Ransomware Groupplatinumpws.com Listed by lockbit5 Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the berjaya-air.com Listed by lockbit5 Ransomware Group →
Publicly posted by lockbit5 — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.