In March 2025, KLIA suffered a ransomware attack by the Qilin gang, crippling critical systems including flight information displays, check-in kiosks, and baggage handling for over 10 hours. Operations reverted to manual processes (whiteboards, paper logs), causing mass disruptions for passengers and airport staff. The attackers exfiltrated ~2 TB of sensitive airport data and demanded a $10 million ransom, which Malaysia’s government publicly refused to pay. The breach vector was likely phishing targeting supplier or contractor accounts, exploiting human error rather than technical vulnerabilities. The incident highlighted systemic risks in interconnected airport ecosystems, where third-party access and high employee turnover amplify exposure. While no direct financial loss was confirmed, the operational chaos, reputational damage, and potential long-term data exposure (e.g., passenger records, vendor contracts) posed severe risks to KLIA’s infrastructure and trust.