Swift Haulage Berhad Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Swift Haulage Berhad, a major Malaysian logistics company, was listed on 12 February 2025 by the ransomware group known as akira. Public reporting indicates the group claims to have exfiltrated internal files during a ransomware attack and states it is ready to upload more than 84 GB of essential corporate documents and financial company information. The number of people affected remains unknown, and independent confirmation of the full scope is limited.

For customers, partners, employees and others who interact with the company, the listing raises practical questions about what data may have left the organisation and what steps are available while details stay incomplete.

Inside the incident

According to available public information, Swift Haulage Berhad appeared on akira’s leak site on 12 February 2025. The group’s own statement asserts that internal files were taken in a ransomware attack and that more than 84 GB of essential corporate documents and financial company information are prepared for release. No further technical details—such as the initial access method, the precise date the intrusion began, encryption status of systems, or any ransom demand—have been disclosed in the material provided.

The volume of people affected is listed as unknown. Beyond the group’s claim of exfiltrated internal files and the stated 84 GB figure, no inventory of specific file names, systems, or confirmed data categories has been released publicly. Timing of any negotiation or actual data publication remains undisclosed.

Inside akira

Akira is a ransomware operation that has been publicly documented since 2023. The group typically employs a double-extortion model: encrypting systems while also copying data and threatening to publish it on a dedicated leak site if payment is not made. Public reporting on prior campaigns shows the group has targeted organisations across manufacturing, education, professional services and logistics, often using stolen credentials, phishing or exploitation of exposed remote-access services to gain initial footholds.

Once inside a network, akira affiliates commonly move laterally, disable security tools, and stage large data archives for exfiltration before deploying ransomware. The group’s leak site serves as both a pressure mechanism and a public claim of responsibility. In this case, the listing of Swift Haulage Berhad and the assertion that more than 84 GB of corporate and financial material is ready for upload should be treated as the group’s claim rather than independently verified fact. No additional statements from akira specific to this victim beyond the volume and nature of the claimed data appear in the available record.

Swift Haulage Berhad and its sector

Swift Haulage Berhad describes itself as Malaysia’s fastest-growing fully integrated logistics provider and is consistently ranked as the top haulier in all major ports in Peninsular Malaysia by twenty-foot equivalent unit (TEU) volume. Organisations of this type manage container movements, inland haulage, warehousing and related supply-chain services that connect ports, manufacturers, importers and exporters.

A logistics operator of this scale routinely holds operational records, customer and partner contracts, shipment schedules, financial ledgers, employee information and communications with port authorities and government agencies. A breach affecting such a firm is consequential because it can expose commercial relationships, pricing, cargo details and internal financials that competitors or criminals could misuse, while also creating secondary risk for the many businesses that rely on the haulier for timely movement of goods.

What was likely exposed

The only data types named in public reporting are “internal files exfiltrated in ransomware attack.” The group further claims readiness to upload more than 84 GB of essential corporate documents and financial company information. Exact contents remain unconfirmed.

Organisations in integrated logistics typically hold the following categories of material; whether any of these were among the claimed files is not established:

• Corporate financial statements, invoices and banking records
• Customer and partner contracts, rate cards and shipment manifests
• Operational schedules, TEU volume reports and port documentation
• Employee records, internal correspondence and system credentials
• Insurance, compliance and regulatory filings

Because the precise inventory has not been disclosed, no specific data type beyond the group’s general description can be stated as fact.

The real-world impact

For individuals whose personal or professional details may have been present in the claimed files, risks include targeted phishing that references genuine company relationships, identity-related fraud if contact or identification data were included, and unsolicited approaches that exploit knowledge of shipments or contracts. For the organisation itself, potential consequences include disruption of haulage operations, loss of commercial confidentiality, regulatory scrutiny under Malaysian data-protection rules, and reputational pressure from customers and port partners who depend on reliable logistics.

Because the number of affected people is unknown and the exact data set unconfirmed, the scale of individual harm cannot yet be quantified. The claimed 84 GB volume of corporate and financial material, if accurate, would be large enough to contain both sensitive commercial information and any personal data stored alongside it, amplifying the need for careful monitoring rather than panic.

Were you affected?

If you are a customer, supplier, employee or partner of Swift Haulage Berhad, treat any unexpected email, call or document request that references the company with caution. Change passwords on accounts that may have been linked to company systems, enable multi-factor authentication where available, and monitor financial and credit activity for unusual behaviour. Keep records of any suspicious contact. Public detail on this incident remains limited; official statements from the company or Malaysian authorities, if issued, should be followed when they appear. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets, providing one practical early-warning step while this specific case continues to develop.

AICompiled with AI assistance from public sources and published under our editorial standards.