Wawasan Dengkil Sdn Bhd Listed by bert Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In a threat landscape where ransomware groups routinely target mid-sized industrial firms for double-extortion leverage, a Malaysian construction company has appeared on a dark-web leak site. Public reporting dated 22 May 2025 states that Wawasan Dengkil Sdn Bhd has been listed by the group known as bert, which claims to have exfiltrated internal files during a ransomware attack. The number of people affected remains unknown, and further technical details have not been disclosed.

For employees, contractors, suppliers and anyone who has shared information with the firm, the listing raises practical questions about what may have left the company’s systems and what steps can reduce residual risk. This article sets out only what is known from the public record and places the incident in context without speculation.

What happened

According to the reported summary, Wawasan Dengkil Sdn Bhd was listed by the bert ransomware group on or around 22 May 2025. The group asserts that internal files were exfiltrated as part of a ransomware attack. No public confirmation has been issued by the company itself, and details such as the precise date of intrusion, the initial access method, the volume of data taken, or whether encryption of production systems occurred remain undisclosed. The number of individuals whose information may be involved is listed as unknown.

The group behind it: bert

Bert is a ransomware operation that follows the now-common double-extortion model: data is stolen before systems are encrypted, and the threat of public release is used to pressure payment. Like other groups of this type, bert maintains a leak site on which it posts victim names and, in some cases, sample files to demonstrate possession. Public reporting on prior campaigns shows that the group has targeted organisations across multiple sectors and geographies, typically advertising the data as available for download if negotiations fail. In the present case the listing of Wawasan Dengkil Sdn Bhd constitutes a claim by the group; independent verification of the volume or sensitivity of any stolen material has not been published.

Wawasan Dengkil Sdn Bhd and its sector

Wawasan Dengkil Sdn Bhd is a Malaysian construction company founded in 2003. It specialises in earthworks, civil engineering, equipment rental and the supply of building materials. The firm has recently been listed on the stock exchange and is described as actively expanding its operations. Construction and civil-engineering firms of this profile routinely hold project documentation, supplier contracts, equipment inventories, employee records, financial data and correspondence with public-sector clients. A breach involving such an organisation can therefore affect not only staff and shareholders but also the broader supply chain and any public infrastructure projects in which the company participates.

What was likely exposed

The only data type named in the public report is “internal files exfiltrated in ransomware attack.” No further breakdown—such as whether the files included personal data, financial records, engineering drawings or credentials—has been provided. Organisations in the construction sector typically store a mixture of commercial, operational and personal information; however, the exact contents of the material claimed by bert remain unconfirmed. Until the company or independent investigators publish a verified inventory, any assertion about specific categories of data would be speculative.

What's at stake

For individuals whose details may appear in the exfiltrated files, the principal risks are identity fraud, targeted phishing and unsolicited contact that leverages knowledge of employment or contractual relationships. For the company, the stakes include potential regulatory scrutiny under Malaysian data-protection rules, disruption to ongoing projects, loss of commercial confidentiality and reputational damage among clients and investors. Because the scale of the incident is unknown, the full extent of these risks cannot yet be quantified. The absence of confirmed numbers does not eliminate the need for vigilance; it simply means that affected parties must proceed on the basis of prudent assumption rather than precise knowledge.

If your data was in this claimed breach

Anyone who has worked for, contracted with or supplied Wawasan Dengkil Sdn Bhd should treat the possibility of exposure seriously until more information emerges. Practical first steps include:

• Monitor bank and credit accounts for unusual activity and consider placing a fraud alert with relevant credit bureaus.
• Change passwords on any accounts that may have reused credentials associated with the company, and enable multi-factor authentication wherever available.
• Be alert to phishing emails or calls that reference construction projects, invoices or employment details that only an insider would know.
• Retain copies of any breach notifications you receive and note the date for future reference.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets. Such a scan does not confirm or rule out involvement in this specific incident, but it provides an additional data point for personal risk assessment. As further verified details become public, those steps can be refined; until then, measured caution remains the most reliable response.

AICompiled with AI assistance from public sources and published under our editorial standards.