The Rhysida ransomware group added MISC Berhad to its leak site on 26 October. MISC is the Malaysian maritime energy shipping group whose main shareholder is Petronas. The gang says it took 29,841 files totalling 28.4 GB, including crew personal data and passwords for systems on board its ships. The ransomware.live tracker recorded the listing that day. MISC has not commented. As of 29 October, Cybersecurity ASEAN had found no public statement from the company, and it has not filed anything about a cyber incident with Bursa Malaysia. No regulator or national CERT has published anything either. Nobody outside the gang has verified the breach.
What Happened
Rhysida's post names MISC Group (miscgroup.com) and calls the company "a world leading provider of international energy-related maritime solutions." Threat intelligence site DeXpose and risk feed QPulse both quoted the post in detail on 27 October. Cybersecurity ASEAN and Undercode News followed with shorter summaries.
Reports disagree on whether any data has been released:
- QPulse says Rhysida "has published" the data.
- DeXpose describes a threat to release data unless the gang's demands are met.
- Cybersecurity ASEAN says the tracker entry shows no ransom amount, no deadline and no sign the data has been published or offered for sale.
Accounts differ, and the more cautious reading is the safer one until someone examines the files. The file count is fairly consistent: 29,841 files according to DeXpose, QPulse and Cybersecurity ASEAN, and "approximately 29,800" according to Undercode News. Undercode's headline says 284 GB, but its article text says 28.4 GB, which matches every other report. The headline looks like a typo.
MISC's most recent Bursa Malaysia announcement is dated 20 October, before the listing appeared. It covers MISC's possible part in a consortium to take Yinson Holdings private and says nothing about a security incident. Separate Edge Malaysia coverage of a fire aboard the MISC chemical tanker Bunga Alpina at Petronas' Labuan methanol terminal has no known connection to the Rhysida claim. Readers should not link the two.
What Was Taken
Everything below comes from Rhysida's own description, as quoted by DeXpose and QPulse. None of it has been independently confirmed.
- Bridge and command workstations: user folders for the Master, Chief Officer and bridge users. DeXpose quotes this as 16,918 files (15.5 GB), including PST mail archives.
- Crew personal data: IMO FAL Form 5 crew lists for about 30 seafarers. Rhysida says these include passport numbers for Malaysian, Filipino, Indonesian and Indian nationals, plus Seafarer Employment Agreements with dates of birth, home addresses and salaries. The post also claims a full passport scan for one fourth officer.
- Shipboard credentials: passwords for ECDIS, CCTV, AIS, and fire and gas alarm panels. The post also lists door access codes, the Ship Security Plan (ISPS) password, NS5/Dualog mail accounts, domain admin credentials and an OCIMF/SIRE web account. QPulse's summary leaves out ECDIS, but DeXpose's quote of the post includes it.
- Internal investigations: a harassment and assault complaint against a Chief Engineer dated 25 August 2026, and an HR investigation report.
- Incident and compliance records: two cases of a vessel listing during ballasting operations, one of which the gang says was never reported to the flag state. The post also lists near misses and about 20 internal ISM non-conformities that it contrasts with clean ABS statutory audits from October 2025, plus a Japanese port state control deficiency from Himeji in December 2025.
- Commercial documents: drydock repair specifications, plus charter delivery and redelivery certificates that name ExxonMobil and APLNG.
The level of detail suggests the gang got into at least one vessel's onboard network, or into systems synced from it, rather than only corporate IT. That is an inference from the claimed contents. MISC has confirmed nothing.
Why It Matters
Leaked crew data is a lasting problem. Seafarers whose passport numbers, addresses and salaries are exposed face identity fraud and targeted phishing, and recruitment scams aimed at crew are already common in the industry. QPulse notes that the crew files would fall under Malaysia's Personal Data Protection Act. The seafarers are of several nationalities, so other countries' data protection rules may also apply.
The credentials are the more urgent problem. If they are real, they give an attacker a map of a ship's network: alarm panels, CCTV, AIS, door access and the ISPS security plan. Password sharing is common on ships, and the same credentials are often reused across a fleet's sister vessels, so a leak from one ship can expose others. ISPS security plan contents are restricted for exactly this reason.
The compliance claims are a third pressure point. Rhysida often uses embarrassing material to push victims to pay. Claims of an incident not reported to the flag state, and internal findings that conflict with clean audits, look chosen to hurt MISC with regulators and charterers.
The listing matches Rhysida's usual targets. Proven Data's tracker shows 303 victims claimed on Rhysida's leak site as of 26 October, 12 of them in the previous 30 days, across 42 countries. Most are in education, healthcare and professional services. QPulse reported another Rhysida leak two days later, about 2.9 TB from municipal and social welfare services in Machelen, Belgium. The group is active and publishes large volumes of data.
The Attack Technique
MISC has not said how, or whether, it was breached, and the leak post does not describe an entry point. What is known about Rhysida comes from previous incidents. Proven Data, an incident response firm, describes the group like this:
- It has been active since May 2023 and has been linked to the same operators who previously ran Vice Society ransomware (tracked as Vanilla Tempest, GOLD VICTOR and other names).
- It uses double extortion: it steals data, encrypts systems, then auctions the stolen data on its Tor leak site.
- It typically gets in through VPN accounts without multi-factor authentication, fake installers signed with real certificates, and TerminalFix lures.
- It encrypts Windows, Linux and VMware ESXi systems, adds a
.rhysidafile extension, and leaves a ransom note namedCriticalBreachDetected.pdf. - A free public decryptor works on early Windows versions of the ransomware but not on every variant.
The claim of domain admin credentials fits Rhysida's usual pattern of getting full control of the Windows domain before stealing data. That is consistent with past cases but has not been confirmed here.
What Organizations Should Do
- Change shipboard passwords across the whole fleet. Shipping operators, and especially MISC's charterers and partners, should change shared passwords for alarm panels, CCTV, AIS, ECDIS, door access and satellite mail accounts. Do this on sister ships too, not just the vessel named.
- Separate ship networks from office networks. Onboard OT and safety systems should not be reachable from bridge office PCs or from domain admin accounts. Check this against IACS UR E26/E27 and IMO MSC-FAL.1/Circ.3.
- Require MFA on every remote access path. VPN accounts without multi-factor authentication are Rhysida's most commonly reported way in. Check VPNs, satellite remote access and vendor support connections.
- Watch for impersonation of MISC and its partners. Charterers, port agents and crewing agencies should be wary of payment-change requests or crew documents that appear to come from MISC. A mailbox leak makes these lures convincing.
- Warn crew who may be affected. Crewing managers should warn seafarers about identity fraud and fake job offers, and plan to notify regulators under PDPA in case the leak is confirmed.
- Hunt for Rhysida indicators. Look for
.rhysidafiles,CriticalBreachDetected.pdfnotes, unusual signed installers and large outbound transfers from bridge or master PCs. Keep affected hosts intact for forensics rather than wiping them first.
Sources: Rhysida Ransomware Gang Claims Attack on Malaysian Shipping Group MISC | Rhysida Ransomware Group Exfiltrates Operational and Crew Data from... | Rhysida Ransomware Attack on MISC Group - DeXpose | Rhysida Ransomware Claims 284 GB Data Theft From Malaysia’s MISC Gr... | Rhysida Ransomware: Attack Chain, IOCs, and Recovery Options | Rhysida Ransomware Group Exposes 2.9 TB of Data from Machelen Munic... | MISC - OTHERS KLSE Screener | Tanker fire halts ops at Petronas’ Labuan terminal