Ma Pak Leung Company Limited Listed by ransomhouse Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 8 June 2026 the ransomware group RansomHouse listed Ma Pak Leung Company Limited on its leak site, stating that internal files had been taken during a ransomware operation. No figure for the number of people affected has been published, and the company has not issued a public statement confirming or denying the claim.

The listing adds one more entry to the growing record of ransomware incidents that continue to affect organisations of all sizes and sectors. When a long-established manufacturer of health products appears on such a site, the immediate questions concern the nature of the files taken and whether personal information is among them.

What happened

The only confirmed public information is the listing itself, dated 8 June 2026. RansomHouse asserts that it exfiltrated internal files from Ma Pak Leung Company Limited. No volume of data, number of files, or timeline of the intrusion has been disclosed. It is not known whether encryption was also deployed or whether any ransom demand was communicated to the company.

Inside ransomhouse

RansomHouse is a ransomware operation that has been publicly active since at least 2021. Like several other groups, it follows a double-extortion model: data are copied before encryption, and the threat actors then publish samples or file listings on a dedicated site to pressure victims. The group’s leak-site postings are claims made by the actors themselves; independent verification of the underlying incidents is not always available at the time of listing.

Who is Ma Pak Leung Company Limited?

Ma Pak Leung Company Limited is a family-owned manufacturer of Traditional Chinese Medicine (TCM) products. Founded in Foshan, Guangdong, in 1822, the firm relocated its base to Hong Kong and was incorporated there in 1958. It develops and produces classical TCM formulations, including Angong Niuhuang Wan, together with modern health-food items such as chicken essence and flavoured TCM candies. The company remains headquartered in Hong Kong under fifth-generation family leadership.

Organisations in this sector routinely maintain records that include customer orders, supplier contracts, research and formulation data, and employee information. A breach therefore carries implications both for commercial confidentiality and for any personal data held in those systems.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No further breakdown of file types or data categories has been released. It is therefore not confirmed whether the material includes customer names, addresses, contact details, health-related information, or financial records. Until the company or an official investigation publishes a more detailed notice, the precise contents remain unconfirmed.

The real-world impact

Individuals whose information appears in the exfiltrated files could face risks of targeted phishing or misuse of personal or health data. For the company, the exposure of formulation details or commercial records could affect competitive position and regulatory compliance obligations in Hong Kong and other jurisdictions where it operates. At present, the scale of these risks cannot be quantified because the number of affected records is unknown.

Were you affected?

Anyone who has purchased products from Ma Pak Leung Company Limited, supplied the firm, or worked there should monitor official statements from the company and any regulatory notices that may follow. A practical first step is to review bank and email accounts for unusual activity and to apply strong, unique passwords with multi-factor authentication. Readers can also run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in previously published incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.