WCT Holdings Berhad Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

WCT Holdings Berhad was listed by the ransomware group thegentlemen on February 11, 2026. The listing states that internal files were exfiltrated during a ransomware attack, yet the number of people affected and the specific contents of any files remain undisclosed. The incident is significant because WCT Holdings Berhad operates across construction, property development and related commercial activities in Malaysia, sectors that routinely process project documentation, partner agreements and operational records.

Breaking down the breach

The only confirmed information is the February 11, 2026 listing itself and the group's assertion that internal files were taken. No independent verification of the attack timeline, encryption of systems or volume of data has been released. The number of individuals whose information may be involved is stated as unknown. No ransom demand amount or payment status has been disclosed.

The group behind it: thegentlemen

Thegentlemen is a ransomware operator that maintains a leak site to publish names of claimed victims. The group typically exfiltrates data before encryption and uses the public listing to increase pressure on the target organisation. Its listings function as an unverified claim until corroborated by the victim or by independent forensic reporting. No additional statements from thegentlemen specific to WCT Holdings Berhad have been recorded beyond the initial listing.

WCT Holdings Berhad and its sector

WCT Holdings Berhad is a Malaysian company with more than 40 years of operation in engineering and construction services. It also participates in property development, operates shopping malls and hospitality assets, and maintains a business aviation division. Organisations of this type manage extensive documentation related to infrastructure projects, supplier contracts, regulatory submissions and client records across multiple commercial sectors.

What was likely exposed

The listing refers only to internal files. No inventory of file types, no confirmation of personal data, and no statement on whether customer, employee or partner records were included have been provided. Companies in the construction and property sector commonly retain project plans, financial ledgers, employee records and third-party agreements, yet the exact composition of any exfiltrated material in this case is unconfirmed.

The real-world impact

Exposure of internal files can create operational and commercial risks for the organisation, including potential disclosure of project details or contractual terms. For individuals whose information appears in those files, the primary concerns are misuse of contact details or credentials if present. Without a confirmed data inventory, the scale of personal exposure cannot be quantified. The organisation has not published a public statement on containment steps or notification timelines.

Were you affected?

Individuals can review any direct correspondence from WCT Holdings Berhad or its subsidiaries for official notices. Checking email addresses against known breach datasets through a reputable exposure scanning service provides an additional means of determining whether personal information has appeared in public listings. Monitoring financial and identity accounts for unusual activity remains a standard precaution when any organisation reports a possible data incident.

AICompiled with AI assistance from public sources and published under our editorial standards.