On September 17, 2025, the LockBit ransomware group added berjaya-air.com to its public leak site, claiming that it had exfiltrated internal files from the Malaysian airline during a ransomware attack.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch berjaya-air.com
Get alerted the next time berjaya-air.com files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about berjaya-air.com’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates the incident involves Berjaya Air, a carrier established in 1989 as part of the Berjaya Group. The data consists of internal files; the precise volume and full list of contents remain undisclosed. No confirmed victim count has been released, leaving uncertainty about how many customers, employees, or partners may be affected. The group set its usual extortion timeline, after which it threatens to publish the stolen data if demands are not met. Available reporting describes the breach as a classic ransomware operation combining encryption with data theft for leverage.
Why This Matters for You and Your Family
When an airline’s internal files appear on a ransomware leak site, the information inside can easily include customer records, booking details, passport numbers, contact information, or employee payroll data. If your family has flown with Berjaya Air, booked tickets for relatives, or if any household member works with the company, your personal details could now sit in attackers’ hands. Credential leaks from such incidents often cascade far beyond the original victim, exposing you to identity theft, phishing campaigns, and financial fraud months or years later. Ordinary families rarely discover the exposure until fraudulent charges appear or unexpected accounts are opened in their name.
The Doxxing and Identity-Chain Implications
Stolen internal files frequently contain email addresses, phone numbers, employee usernames, or customer loyalty records. Attackers and opportunistic criminals then link these fragments across dozens of other breaches. A single leaked email can reveal your username on shopping sites, gaming platforms, or social media. Once those connections form, doxxing chains emerge: home addresses, children’s names, and family photos become easier to locate. Credential leaks like this one routinely lead to account takeovers on gaming services, where children’s accounts are hijacked for further extortion or to harvest additional personal data. The chain reaction turns one corporate breach into a persistent privacy threat for your entire household.