Garuda Indonesia Listed by mallox Ransomware Group

On July 09, 2023, Indonesian national airline Garuda Indonesia appeared on the leak site operated by the mallox ransomware group. The listing states that the airline suffered a ransomware attack in which internal files were exfiltrated. The group claims to have stolen company data and is using the public posting to pressure the victim, although the exact volume of records and the full scope of information taken remain undisclosed by both the attackers and the airline.

Reported Details from the Leak Site

The mallox leak page for Garuda Indonesia, first noted on 9 July 2023, asserts that the airline’s internal files were taken during a ransomware incident. The disclosure does not quantify how many records were affected, list specific data types such as passenger details or employee records, or provide a ransom demand figure. It simply states that data was exfiltrated and is now held by the group. As is typical with these listings, the page serves as both proof of compromise and a countdown mechanism to further data publication if the victim does not pay.

Internal files exfiltrated is the only description given. No samples of the stolen material have been publicly released on the site at the time of the initial listing, leaving customers, employees, and partners uncertain about precisely what may have been taken.

Why This Matters for You and Your Family

When an airline the size of Garuda Indonesia is breached, the ripple effects reach ordinary travellers and their households. Flight bookings, passport numbers, contact details, and payment information are common holdings in airline systems. Even if the leak site does not explicitly confirm these categories, the nature of “internal files” in a national carrier makes it reasonable to assume sensitive personal data linked to millions of passengers could be at risk. If your family has flown with Garuda, your information may now sit in an attacker’s archive.

The breach also affects current and former employees whose payroll, health, or HR records may have been stored on the same networks. A single exposure like this can feed identity theft, tax fraud, or phishing campaigns tailored to look like official airline communications. For families, that risk extends to children whose travel records or family-linked accounts become part of the chain.

The Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at one dataset. Once internal files leave the victim’s control, they can be cross-referenced with other breaches to build detailed profiles. An email address allegedly taken from Garuda can be matched to credentials from earlier leaks, linking your travel history to banking, social media, or children’s gaming accounts. These identity chains allow attackers to doxx individuals, impersonate family members, or sell ready-made profiles on underground markets.

Credential leaks like this one cascade into account takeovers. A reused password from an airline booking portal can unlock email, which then unlocks everything else. Gaming accounts belonging to children are especially vulnerable because they often share family email addresses or phone numbers and lack strong authentication. The result is a widening circle of exposure that can affect every member of the household.

Mallox Group’s Known Track Record

Public reporting attributes the mallox ransomware operation to a group that emerged in late 2021. The actors have targeted organisations across Asia, Europe, and North America, with a focus on mid-to-large enterprises including manufacturers, healthcare providers, and transportation firms. Their typical playbook begins with phishing or exploitation of remote desktop services for initial access, followed by rapid lateral movement, data exfiltration, and deployment of ransomware. After encryption, they wait a short period before publishing victim names on their leak site and threatening to release stolen files if payment is not made.

Mallox has shown willingness to follow through on publication when victims ignore demands, although the group’s overall scale remains smaller than some of the more notorious ransomware families. Their emphasis on public shaming through leak sites adds pressure on companies that rely on customer trust, such as airlines.

What to do

• Run a DoxxScan to map every link between your travel emails, booking references, phone numbers, and real-world identity, with cleanup handled by specialists.
• Rotate any password you have ever used on the Garuda Indonesia website or app, especially if it appears anywhere else, and switch on 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure that touches you or your family is flagged within hours.
• Cover the entire household — DoxxScan family coverage includes dependents and children’s gaming accounts that often chain back to the same addresses and credentials exposed in breaches like this.
• Let remediation specialists manage takedown requests for any personal data already appearing on broker sites or forums tied to the incident.

The Garuda Indonesia listing is a reminder that even national carriers can be forced into the open by ransomware operators. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage provide a practical way for families to stay ahead of these expanding risks, including protection for children’s gaming accounts that frequently become targets once personal data leaks.