Rhysida claims theft of 28.4 GB from Malaysian shipping firm MISC
The Rhysida ransomware group listed MISC Group, the Malaysia-based energy shipping and maritime services company, on its leak site, claiming about 29,800 files (28.4 GB) from onboard vessel workstations, including crew records with passport numbers and shipboard system credentials. MISC has not commented publicly and the claim has not been independently verified, per DailyDarkWeb. Monitor official statements; if you operate with MISC, review access and rotate onboard and shore credentials.
What happened
The Rhysida ransomware group claims to have stolen about 29,800 files (28.4 GB) from MISC Group, a Malaysia-based energy shipping and maritime services company. According to the group, the data comes from onboard vessel workstations and includes crew records with passport numbers, employment contracts and shipboard system credentials. MISC has not commented and the claim is unverified.
Why it matters
If confirmed, the leak exposes crew personal data, risking identity fraud, and credentials that could open access to vessel navigation, security and communication systems. Charters, drydock documents, audit findings and internal investigation reports could also leak. There is operational, regulatory and reputational risk for the maritime sector.
What to do
Track official MISC statements; today the claim comes only from the criminal group. If your company operates vessels or connects with MISC, review access and rotate onboard and shore credentials. Warn seafarers about crew-agency or payroll-themed phishing.
For the technical team
- Affected
- MISC Group (empresa malaia de transporte marítimo e serviços de energia); estações de trabalho a bordo de embarcações · MISC Group (Malaysia-based energy shipping and maritime services company); allegedly onboard vessel workstations.
- Exploitation
- Claim posted on the Rhysida leak site on 2026-10-26, reported by DailyDarkWeb. No comment from MISC and no independent verification. No specific vulnerability cited.
- Fix
- No patch: no vulnerability cited. Mitigation suggested by DailyDarkWeb: rotate onboard and shore credentials.
- More details
- Haul claimed by the group: PST mail archives, crew records with passport numbers and employment contracts, shipboard system and account credentials, internal investigation and incident reports, audit findings, and drydock and charter documents. DailyDarkWeb analyst note: if genuine, shipboard credentials could expose vessel navigation, security and communication systems, and crew data could fuel identity fraud. Unverified threat-actor claim, not confirmation of a breach.
Timeline
Rhysida gang claims theft of 28.4 GB of data, including crew records and credentials.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
