Qilin Ransomware Group Claims Attack on Malaysia Airlines The Qilin ransomware gang has listed Malaysia Airlines on its dark web leak site, marking the latest in a series of cyberattacks targeting the aviation sector. The group, which operates under a ransomware-as-a-service (RaaS) model, has rapidly escalated its activities, emerging as the most active ransomware operation of 2025 with over 1,000 victims that year and more than 200 additional claims in early 2026. The incident, dated February 22, 2026, remains unconfirmed by Malaysia Airlines or investigators, as Qilin has yet to provide proof of stolen data unlike its typical tactic of releasing file samples to pressure victims. The lack of evidence leaves uncertainty about whether the attack involved a confirmed breach, a failed intrusion, or a negotiation ploy. No details have been disclosed regarding potential exposure of passenger data, employee records, or operational systems. This follows a March 2025 ransomware attack on Kuala Lumpur International Airport (KLIA), also attributed to Qilin, which disrupted flight information displays, check-in systems, and baggage handling for over 10 hours. The aviation industry has become a prime target for ransomware groups, drawn by the combination of operational leverage and access to sensitive personal and corporate data. Qilin, linked to Russian cybercriminal networks, has expanded its victim pool beyond traditional sectors like finance and healthcare to include critical infrastructure, government agencies, and transportation entities. Past attacks on airlines and airports have exposed passenger names, passport details, and internal documents, raising concerns about identity fraud and phishing risks. Malaysia’s aviation sector has faced repeated cyber threats, including a 2022 ransomware attack on AirAsia by the Daixin Team and a 2020–2021 data breach at Malaysia Airlines. While the current claim lacks verification, analysts note that ransomware groups often withhold evidence during negotiations, with data dumps or public disclosures occurring only if talks fail. The incident underscores the growing vulnerability of global aviation to cyber extortion, with ransomware gangs increasingly prioritizing high-impact targets for financial gain and operational disruption.

AirAsia Group was targeted by Daixin ransomware group that exposed 5M UNIQUE Passenger personal data, and all employee's personal data leaked. The exposed information includes the date of birth, country of birth, where that person is from when employed for employees and the “secret question and answer” used to secure accounts. The group claims that after encrypting its database and requesting an unspecified price to unlock it and reveal how it gained access to the network, it gave AirAsia a sample of the data. In order to avoid encrypting or destroying anything that would be life-threatening, Daixin Team stated it had avoided locking up crucial files linked to flying equipment. However, it has entirely restricted access to staff and passenger records until payment has been received.