The ransomware and data-extortion group Panzer has added Malaysia's Ministry of Health to its leak site and says it stole about 16GB of data from the ministry. The threat intelligence platform ThreatMon first spotted the listing on 12 November 2026, and Undercode News then reported it. At the time of writing the claim is unverified. The ministry has made no public statement, and neither CyberSecurity Malaysia nor any other national authority has published anything on the alleged incident. Panzer has not released data samples, record counts or any detail of how it got in. Everything below about the breach comes from what the group says. Defenders should treat it as an active claim, not a confirmed compromise.
What Happened
Undercode News reports that the Panzer listing names the Ministry of Health Malaysia as the victim. It classes the ministry under Government and Public Administration and gives a data volume of roughly 16GB. The report marks the claim as "unconfirmed" and says no official confirmation from the ministry has been provided.
The pattern is a common one. A group puts a victim on its leak site, names a data volume, and uses the public listing to push for payment or to build its reputation. Whether Panzer encrypted any ministry systems is not known. No service disruption has been reported. Nothing public suggests health services were affected.
The listing comes in a busy period for attacks on Malaysian government systems:
- Dewan Bahasa dan Pustaka (DBP): In October 2026, researcher Nigel Aw documented a compromise of the government language agency's websites. Attackers injected 111 hidden gambling links into dbp.gov.my, replaced a subdomain with a casino page, and served gambling content to Google's crawler on the agency's exam portal. Aw reports that the exam-portal issue was still unfixed as of 19 October.
- Royal Malaysian Customs Department: On 21 October 2026, Darkwiser reported a dark web forum listing. A seller using the handle "marlanwg" offered unauthenticated PHP webshell access and production MySQL database access to a customs.gov.my portal for $1,500. Darkwiser rates the listing as unverified.
- CyberSecurity Malaysia advisory: Through its Cyber999 Incident Response Centre, CyberSecurity Malaysia has issued an alert. It says Malaysian organisations face ongoing data breaches, ransomware, credential compromise, server compromise and web defacements.
None of these incidents has been linked to Panzer. They do show that Malaysian government web systems are being probed, compromised and sold.
What Was Taken
The only figure available is Panzer's own claim of about 16GB. No independent party has seen or verified the data. The group has not said what the data contains, how many people it covers, or which ministry systems it came from.
Undercode News notes that a national health ministry can hold patient and medical records, personnel files, internal communications, procurement documents and records about health infrastructure. The outlet also states plainly that there is no evidence any of these categories were accessed. That caution applies here too. 16GB could be a set of administrative file shares or a slice of a clinical database, and the two carry very different consequences. Until samples appear or the ministry comments, the contents are unknown.
Why It Matters
Health data is among the most sensitive data a government holds. If patient or medical records are in the set, the harm lasts. Diagnoses and identity numbers cannot be reset like passwords.
Malaysia's breach-notification law may not cover this incident. Since 1 June 2025, section 12B of the Personal Data Protection Act 2010 (PDPA) has required data controllers to notify the Personal Data Protection Commissioner of personal data breaches. Accounts of when the duty applies differ:
- Connext Consulting says notification applies where a breach causes, or is likely to cause, significant harm.
- WorkQuest2U says it also applies where more than 1,000 people are affected.
Both describe the same limits: notify the Commissioner within 72 hours, and notify affected individuals within 7 days where significant harm is likely. WorkQuest2U puts the penalty for failing to notify at up to RM250,000 and/or two years in prison.
However, Rocket Web, citing Malaysia's Personal Data Protection Department (JPDP), notes that the PDPA covers personal data processed in commercial transactions and does not apply to the Federal Government or State Governments. A federal ministry is therefore probably outside the statutory 72-hour regime. This means there may be no legal deadline forcing the ministry to say anything publicly, even if the breach is real. Patients and staff may have to rely on the ministry choosing to disclose.
Third parties extend the exposure. Lionster's analysis of the Malaysia Airlines incident, where customer data was exposed through the reservation vendor Amadeus, is a reminder that large organisations hand data to many suppliers. If Panzer's data came from a contractor or hosted platform rather than the ministry's own network, the breach could be wider than one agency.
The Attack Technique
No one has disclosed how Panzer allegedly got in. The group has not said, and the ministry has not commented.
The surrounding activity points to likely routes, though none is tied to this case:
- Vulnerable web applications: The customs listing advertised PHP code execution and direct database access through a government portal.
- Weak website maintenance: The DBP compromise involved injected content and crawler-targeted redirects that stayed in place for days after they were found.
- Common entry points: CyberSecurity Malaysia's advisory lists credential compromise, server compromise and misconfiguration-driven information disclosure among the incidents it handles.
Data-extortion groups often buy access that has already been established, such as webshells or stolen credentials. They do not always break in themselves. Agencies should treat access-broker listings like the customs one as early warnings for the whole government network, not only for the agency named.
What Organizations Should Do
- Hunt for webshells and unauthorised database access on public-facing portals. Review web roots for unexpected PHP files and audit database accounts used by web applications. Check outbound connections from web servers. CyberSecurity Malaysia also recommends enabling logging and keeping logs long enough to investigate.
- Patch internet-facing systems, plugins and appliances. Cyber999 tells administrators to upgrade unsupported operating systems and software and to apply vendor patches to web applications and network devices.
- Check what your sites serve to search engines. The DBP case showed content served only to Googlebot. Fetch your pages with a crawler user agent, review raw HTML for hidden links, and watch search results for your domain.
- Keep offline backups and test restoring them. Panzer runs ransomware as well as data theft. Cyber999 recommends daily backups to separate media stored offline at a second site.
- Map who holds your sensitive data. List the vendors and hosted platforms that process patient, staff or citizen data. Write breach-reporting duties into their contracts, as the PDPA guidance recommends for private-sector controllers.
- Prepare to notify even when the law does not require it. Public bodies outside the PDPA should still adopt a 72-hour internal standard for assessing incidents and informing affected people. Monitor leak sites and dark web forums for your domains so a listing like Panzer's is not the first you hear of a breach.
Sources: Panzer Claims 16GB Data Breach at Malaysia’s Ministry of Health, Ra... | PDPA Data Breach Notification Malaysia: The 72-Hour Rule - Connext... | Data breach notification in Malaysia: 72 hours · WorkQuest2U | Customer Data Sent to an AI App: A First 24-Hour Response Pl — Rock... | Malaysia Airlines data breach: check your vendors Lionster | CyberSecurity Malaysia | Investigating the hijack of a Malaysian government site by a gambli... | Royal Malaysian Customs Department Webshell Access Exposed on Dark...