Key Takeaways
- RansomHub ransomware group claimed to have stolen 316GB of data from Prasarana Malaysia Berhad in 2024
- Prasarana operates Kuala Lumpur's RapidKL buses, LRT, MRT and Monorail — a critical public transport network
- The attack underscored how threat actors are expanding beyond banking and healthcare to mobility infrastructure
- Malaysia saw a 153% increase in ransomware incidents in 2024 according to Kaspersky data
- RansomHub emerged in 2024 and rapidly became one of the most active ransomware groups globally after the BlackCat/ALPHV disruption
The Facts
When most Malaysians think about cybersecurity risks, they picture bank fraud or data breaches at telcos. The 2024 attack on Prasarana Malaysia Berhad — the government-linked company that runs KL Sentral-connected LRT lines, MRT, Monorail and RapidKL buses serving millions of daily commuters — expanded that mental model abruptly.
RansomHub, a ransomware-as-a-service operation that emerged in early 2024 and rapidly built a victim portfolio after the law enforcement disruption of BlackCat/ALPHV, claimed responsibility. The group said it exfiltrated 316GB of data from Prasarana's systems.
Prasarana has not disclosed what, if anything, was taken from the operator of a network that moves hundreds of thousands of people daily across Greater Kuala Lumpur. In a statement on 26 August 2024, it said the incident did not affect its daily operations, and that it was working with the National Cyber Security Agency (NACSA) and CyberSecurity Malaysia.
Prasarana's public response was measured — the company acknowledged the incident without providing detailed technical disclosure, a communication approach consistent with ASEAN's general preference for limited breach disclosure that stands in contrast to the more disclosure-intensive regulatory environments in the EU and US.
Technical Deep-Dive
RansomHub's operational model mirrors the double extortion approach pioneered by earlier groups: infiltrate, exfiltrate, encrypt, and threaten both operational recovery and data publication unless ransom is paid. What distinguishes RansomHub is its aggressive affiliate recruitment — the group reportedly offered affiliates an unusually high 90% revenue share, enabling it to scale rapidly by attracting experienced operators from disrupted competing groups.
Public transport infrastructure presents a specific attack surface. Operational systems for ticketing, fare gates, fleet management, and real-time passenger information are increasingly networked — with interfaces connecting operational technology to enterprise IT systems. These integration points, which enable centralised management and passenger app services, also create pathways from internet-exposed enterprise systems into operational infrastructure.
For organisations like Prasarana, the challenge is that many of these operational systems were deployed before modern security controls were standard requirements, and the operational risk of taking them offline for patching and upgrades is high — creating extended windows of exposure.
The ASEAN Perspective
Malaysia's public transport operators are not isolated targets. Singapore's SMRT, Thailand's BTS Skytrain operator, and Indonesia's TransJakarta are comparable organisations in terms of operational profile, public service criticality, and — in many cases — similar technology estate profiles.
The Prasarana incident, followed seven months later by the attack on KLIA, creates a pattern: Malaysia's critical infrastructure is being tested systematically. Whether this represents coordinated targeting or opportunistic exploitation of exposed vulnerabilities, the outcome for Malaysia's national cyber posture is the same — critical infrastructure requires dedicated security budgets and OT-specific protection programmes, not just enterprise IT security frameworks applied broadly.
RECATOOLS Verdict
If authentic, the 316GB claimed by RansomHub could provide attackers with operational intelligence useful for future targeted attacks, social engineering of employees, and potentially insight into infrastructure vulnerabilities.
The lesson for ASEAN public transport and mobility operators is to treat network architecture — specifically the segmentation between passenger-facing systems, enterprise IT, and operational technology — as a strategic security investment, not a technical detail.
Sources
- Security Quotient Malaysia Cyber Threat Landscape 2025
- CyberSecurity Malaysia Incident Reports 2024-2025
- Kaspersky APAC Threat Intelligence 2024
FAQ
What is Prasarana Malaysia? Prasarana Malaysia Berhad is a government-linked company operating Greater KL's public transport network including RapidKL buses, LRT, MRT, and Monorail.
What is RansomHub? A ransomware-as-a-service group that emerged in early 2024, rapidly becoming one of the most active operators after law enforcement disrupted BlackCat/ALPHV. Known for offering 90% revenue share to affiliates.
How much data was stolen from Prasarana? RansomHub claimed to have exfiltrated 316GB of data. The exact contents were not publicly disclosed by Prasarana.
Did Prasarana pay the ransom? Prasarana did not publicly confirm whether a ransom was demanded or paid.
Did the incident disrupt services? Prasarana said on 26 August 2024 that the incident did not affect its daily operations.
Why is public transport a ransomware target? Operational criticality creates ransom pressure, networked OT systems often have security gaps, and sensitive data (passenger records, infrastructure documentation) has value to attackers.
Correction, 18 October 2026: An earlier version stated as fact that employee records, infrastructure documentation and financial data had been stolen, and speculated about how long the attackers had been inside Prasarana's systems; neither is established, and RansomHub's claim has not been verified. It also wrongly placed the KLIA attack in the same year. Prasarana's statement that daily operations were unaffected has been added.
View author profile → · Editorial policy
