prasarana.com.my Listed by ransomhub Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 10 August 2024, the Malaysian public transport operator prasarana.com.my appeared on a leak site operated by the ransomware group known as ransomhub. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical details of the intrusion have not been disclosed.

The listing itself is a claim by the group. Independent confirmation of the full scope of the incident has not been made public. For an organisation that runs major urban rail and bus networks, any confirmed compromise of internal systems carries practical consequences for operations and for individuals whose information may have been held in those systems.

Inside the incident

According to the available record, prasarana.com.my was listed by the ransomhub ransomware group on 10 August 2024. The only data description provided is that internal files were allegedly exfiltrated in a ransomware attack. No figure has been given for the volume of data, the number of systems involved, or the number of individuals whose information may have been included. The precise method of initial access, the timeline of the intrusion, and whether encryption was also deployed remain undisclosed in public sources.

Because the listing originates from the threat actor’s own site, it must be treated as an unverified claim until corroborated by the organisation or by independent investigators. No official statement confirming or denying the full extent of the breach has been incorporated into the facts available for this account.

The group behind it: ransomhub

Ransomhub is a ransomware operation that has been active in the public domain since early 2024. Like many contemporary groups, it is widely reported to operate on a ransomware-as-a-service model, in which affiliates conduct intrusions and share proceeds with the core developers. The group’s typical pattern involves double extortion: data is first stolen, then systems may be encrypted, after which the victim is threatened with public release of the stolen material if a ransom is not paid.

Ransomhub maintains a leak site on which it posts the names of organisations it claims to have compromised, often accompanied by sample files or countdown timers. Public reporting has linked the group to multiple sectors, including government, manufacturing and transportation, though each listing remains a claim until verified. In the present case the group claims that prasarana.com.my was among its victims and that internal files were taken; no additional statements attributed specifically to this incident appear in the available facts.

Who is prasarana.com.my?

Prasarana Malaysia Berhad is a major public transportation provider in Malaysia. It manages urban rail and bus services in key metropolitan areas and operates the Rapid KL, Rapid Penang and Rapid Kuantan networks. The organisation is also responsible for infrastructure development and maintenance that supports sustainable urban mobility across the country.

As a large state-linked transport operator, Prasarana holds operational data, employee records, contractor information, passenger-related systems and technical documentation for rail and bus networks. A breach of such an organisation is consequential because disruption or data exposure can affect daily transit for large numbers of people and can reveal sensitive operational or personal information that is not intended for public release.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, databases or personal data categories has been disclosed. Organisations of this kind typically maintain employee personnel files, contractor and vendor records, operational schedules, infrastructure plans, financial documents and, in some cases, limited passenger or customer information. Whether any of those categories were among the files taken remains unconfirmed.

Because the exact contents have not been published, it is not possible to state with certainty which individuals or which specific data elements were exposed. The only confirmed description is the exfiltration of internal files claimed by the listing group.

Why it matters

For people whose details may have been stored in the organisation’s systems, the principal risks are identity misuse, targeted phishing and unsolicited contact that leverages knowledge of employment or travel patterns. Even when the precise data set is unknown, the mere fact of an internal-file exfiltration raises the possibility that personal identifiers, contact details or employment information could later appear in criminal markets.

For the organisation itself, the incident raises questions of operational continuity, regulatory notification obligations under Malaysian data-protection rules, and the potential for secondary attacks that exploit any residual access or stolen credentials. Public confidence in transport systems can also be affected when a major operator appears on a ransomware leak site, regardless of whether the full technical impact is ever confirmed.

What to do if you're exposed

If you have a current or former relationship with Prasarana Malaysia Berhad—as an employee, contractor, supplier or regular passenger—consider the following practical steps:

• Monitor bank and credit accounts for unexpected activity and enable transaction alerts where available.
• Treat unsolicited emails, calls or messages that reference the organisation or your personal details with heightened caution; verify any request through official channels.
• Change passwords for accounts that may have used the same credentials as any Prasarana-related systems, and enable multi-factor authentication wherever possible.
• Request a free exposure scan of your email address to check whether it has already appeared in known breach data sets.
• If you receive formal notification from the organisation, follow the specific guidance it provides and retain a copy of the notice.

Public detail on this incident remains limited. Further official statements from Prasarana or Malaysian authorities would be required to clarify the true scale and the precise data involved. Until then, individuals can only act on the information that has been made available and on standard protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.