Southern Lion Sdn Bhd Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Southern Lion Sdn Bhd was listed by the incransom ransomware group on 24 November 2025 after internal files were exfiltrated in a ransomware attack. Individuals should verify whether their information was exposed and take the appropriate steps to protect themselves.
Individuals whose information is held by Malaysian consumer-goods companies now face the possibility that internal records have been copied and may be published. A ransomware group has listed Southern Lion Sdn Bhd, yet the number of people affected and the precise contents of any files remain unknown.
The listing appeared on 24 November 2025. Public information is limited to the group’s claim that files were taken during a ransomware operation; no independent confirmation of the incident’s scope or date has been released.
What happened
Southern Lion Sdn Bhd was listed on the leak site maintained by the incransom ransomware group on 24 November 2025. The group states that internal files were exfiltrated during a ransomware attack. No public details have been provided on when the intrusion occurred, how many records were involved, or the technical method used to gain access.
The group behind it: incransom
Incransom is a ransomware operator that publicly lists victim organisations on a dedicated site when negotiations fail or to apply pressure. The group follows the common pattern of claiming to have encrypted systems and copied data, then threatening to release the material unless a ransom is paid. Its listings are presented by the group itself and are not independently verified at the time of publication.
Southern Lion Sdn Bhd and its sector
Southern Lion Sdn Bhd operates as an equal joint venture between Lion Corporation of Japan and Lam Soon (M) Bhd. It functions as a fast-moving consumer goods marketing company active in Malaysia, building and distributing household and personal-care brands. Companies in this sector routinely maintain records relating to customers, retailers, employees and supply-chain partners.
What was likely exposed
The only information released so far is that internal files were taken. The exact categories of data have not been disclosed. Organisations of this type commonly store employee details, business correspondence, sales records and marketing information; whether any of these categories are present in the exfiltrated material is unconfirmed.
The real-world impact
Exposure of internal files can lead to follow-on fraud attempts, misuse of contact information or reputational harm for the individuals and partners named in the records. For the company, the incident adds operational disruption and the cost of investigation and remediation. The absence of confirmed data types means the scale of personal risk cannot yet be quantified.
Were you affected?
Anyone who has dealt with Southern Lion Sdn Bhd or its brands can contact the company directly for information on the incident. Individuals should monitor their financial and email accounts for unusual activity and consider changing passwords. A free exposure scan of an email address against known breach data can provide an initial indication of whether the address has appeared in previously published data sets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
glasserstv.com Listed by incransom Ransomware Groupoxfordshop.com.au Listed by incransom Ransomware GroupAmerican Pools & Spas Listed by incransom Ransomware GroupSchmidt's Listed by incransom Ransomware GroupLatest breaches
Publicly posted by incransom — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.