Threat actor alleges APAD breach, claims data theft and wipe
A threat actor on an underground forum claims to have breached the systems and official email of APAD, Malaysia's land public transport regulator under the Ministry of Transport. The actor claims to have extracted documents including employee MyKad data and contracts (Toshiba is named), to have 'wiped' the systems, and threatens to publish the data if unspecified demands are not met. The claim is not independently verified; monitor the group's posts and official confirmation from the agency.
What happened
A threat actor on an underground forum claimed on October 26, 2026 to have breached the systems and official email of APAD, the Malaysian government agency that regulates land public transport. The actor claims control of servers, extraction of internal documents, and that the systems were 'wiped', and threatens to publish the data if unspecified demands are not met. The claim has not been independently verified and the agency has not confirmed it.
Why it matters
If authentic, the breach exposes Malaysian civil servants' personal data, including MyKad national identity card numbers, a strong enabler of identity fraud, SIM-swap and targeted phishing, according to DailyDarkWeb's analyst note. Contractor documents, with Toshiba named, could be abused for supply-chain lures. The 'wiped systems' claim could affect agency operations if proven true.
What to do
Await official APAD confirmation and monitor the forum and the group's channels for data publication. Alert cited employees and contractors to phishing and misuse of MyKad data. Teams integrated with APAD should review contacts and channels with the agency.
For the technical team
- Affected
- Agência de Transporte Público Terrestre da Malásia (APAD), vinculada ao Ministério dos Transportes; sistemas digitais e · Digital systems and official email of APAD (Land Public Transport Agency of Malaysia), under the Ministry of Transport. No versions cited.
- Exploitation
- Unverified claim reported by DailyDarkWeb in a post on X, with the underlying source restricted to subscribers. The actor attached a data sample and is extorting under threat of publication. No confirmed compromise.
- Fix
- No fix applicable; the breach is unconfirmed. Mitigation: monitor for data publication and prepare notification and incident response if APAD confirms.
- Vector
- Not described in the sources. The actor claims control of APAD servers and official email; no initial access details.
- More details
- The actor claims the systems were 'wiped'. Allegedly exfiltrated data includes employee schedules and personal data (MyKad numbers), insurance documents, internal maintenance records, confidential government correspondence on competency development and administrative reforms, and contracts with major companies (Toshiba is named). Claim surfaced on 2026-10-26 per the timeline. Not confirmed by the agency or independently verified.
Timeline
Claim of APAD breach and employee data theft surfaced on an underground forum.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
