Naza TTDI Sdn Bhd Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by listing them on leak sites and threatening to release internal material, a pattern that has become a routine feature of the current cyber-threat landscape. On 2 April 2025, the group known as akira publicly listed Naza TTDI Sdn Bhd, a Malaysian property-development company, claiming it had exfiltrated internal files during a ransomware attack.

The number of people affected remains unknown, and independent confirmation of the full scope is limited. What is known comes from the group’s own listing and the organisation’s public profile; that information is set out below so that employees, customers and partners can assess potential exposure calmly and take practical steps.

What happened

According to publicly reported details, Naza TTDI Sdn Bhd was listed by the akira ransomware group on 2 April 2025. The group asserts that it conducted a ransomware attack in which internal files were exfiltrated. No precise date of the intrusion itself, no confirmed file volume, and no verified count of affected individuals have been disclosed in the available record. The listing itself constitutes the group’s claim that it holds and is prepared to publish corporate material; that claim has not been independently verified in the facts provided.

The group behind it: akira

Akira is a well-documented ransomware operation that emerged in the public eye in 2023 and has since targeted organisations across multiple sectors and regions. The group typically gains initial access through compromised credentials or exposed remote-access services, encrypts systems, and simultaneously steals data so that it can threaten public release if a ransom is not paid. Its leak site is used both to name victims and to post samples or full archives once a deadline passes. Akira’s public activity has included listings of companies in manufacturing, professional services and real estate, among others. In this instance the group claims it is ready to upload a substantial set of Naza TTDI’s corporate documents; those assertions remain the group’s own statements rather than independently What's Publicly Reported.

Naza TTDI Sdn Bhd and its sector

Naza TTDI Sdn Bhd is a property-development firm that has established its presence through large-scale township and building projects centred on the Klang Valley in Malaysia. Public descriptions of its work include the 662-acre Taman Tun Dr Ismail, TTDI Alam Impian, Stadium Malawati, Masjid Al-Ikhlas and TTDI Jaya. Organisations of this type routinely manage land titles, construction contracts, joint-venture agreements, employee records, customer contact lists and financial documentation. A breach involving such an entity therefore carries implications not only for the company’s own operations but also for the privacy of staff, buyers, contractors and other parties whose details may appear in project files.

The information in question

The available facts state that internal files were exfiltrated in a ransomware attack. The akira group further claims it holds and is prepared to publish material that includes corporate NDAs, employee passport numbers, corporate licences, agreements and contracts, contact numbers and e-mail addresses of employees and customers, and financial data such as audits, payment details and reports. Exact contents, file counts and the proportion of any given data type remain unconfirmed outside the group’s listing. Property developers typically retain precisely these categories of records in the ordinary course of business; whether every item listed by akira is present, complete or accurate cannot be verified from the public record alone.

The real-world impact

If the claimed material is authentic and is released, individuals whose passport numbers, personal contact details or employment records appear could face elevated risks of identity fraud, targeted phishing or social-engineering attempts. Customers whose e-mail addresses or contract information surface may receive unsolicited messages that appear legitimate because they reference real project or payment details. For the organisation itself, exposure of financial audits, licences and commercial agreements can create competitive disadvantage, regulatory scrutiny and the need for costly remediation and notification work. Because the number of people affected is unknown, the precise scale of these risks cannot yet be quantified; the prudent course is to treat the possibility of exposure as real until further clarity emerges.

Were you affected?

Anyone who has worked for, contracted with or purchased property from Naza TTDI Sdn Bhd should consider the following practical steps:

• Monitor bank and credit accounts for unexpected activity and enable transaction alerts where available.
• Treat unsolicited e-mails or calls that reference company projects, contracts or payments with caution; verify through known official channels before responding or clicking links.
• Change passwords on any accounts that may have reused credentials associated with work or customer portals, and enable multi-factor authentication.
• If you hold a Malaysian identity document whose number may have been stored by the company, remain alert for signs of identity misuse and consider placing a fraud alert with relevant credit bureaux.
• Run a free exposure scan of your e-mail address against known breach data sets to check whether your information has already appeared in public dumps.

Public detail on this incident remains limited. Further official statements from the company or Malaysian authorities, if issued, should be treated as the primary source of updated guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.