Antah HealthCare Group Data Breach

Antah HealthCare Group (AHCG), a Malaysian healthcare conglomerate operating facilities and medical services through its ahcg[.]com[.]my platform, was listed on Crypto24’s dark-web leak portal on October 27, 2026. The listing was identified via SOCRadar Dark Web Monitoring and coincides with a coordinated dual disclosure by Crypto24 that also named DATEM, Inc., a Philippine technology company, on the same day. As a healthcare organization in Southeast Asia, AHCG aligns with the sectors Crypto24 has been actively targeting, and the exposure of medical conglomerates carries heightened risk given the sensitivity of healthcare data and the operational dependence on interconnected facilities and services. Crypto24 is a nascent ransomware operator with a small but growing footprint, having claimed 3 victims over the past 60 days. Known targeting focuses on the Technology and Healthcare sectors across Southeast Asia, with victims in the Philippines, Malaysia, and Singapore. The dual disclosure of DATEM, Inc. and AHCG on October 27, 2026 suggests coordinated ASEAN targeting, and this October 27 batch represents a visible step up in the group’s operational tempo. The current listing fits squarely within Crypto24’s typical sector and geographic pattern, reinforcing the assessment that the group is actively concentrating on Southeast Asian healthcare and technology targets.

SOCRadar credential telemetry for ahcg[.]com[.]my returned one record: a corporate employee credential with a domain matching the target, located on the organization’s mail infrastructure and classified as Category-A. Although this is a single record, its location on mail infrastructure carries elevated significance, as mail systems are high-value targets in both the reconnaissance and lateral movement phases of ransomware intrusions. The insert and log dates fall in October 2026, indicating recent harvesting timed close to the leak-site listing. The presence of a recently harvested corporate mail credential in the context of a concurrent ransomware listing suggests a plausible intrusion path, though it does not confirm that this exact access method was used. Infostealer-harvested credentials on mail infrastructure can support initial access, reconnaissance of internal communications, and lateral movement leading toward ransomware deployment. Because the telemetry result reflects a limited sample, the absence of additional records does not confirm that the organization is unaffected: credentials may exist under alternate corporate domains or personal email aliases, in feeds outside the queried dataset, or may have been used and rotated before indexing, and not-yet-indexed data may also be omitted. Given the combination of a confirmed Category-A mail-system credential and a concurrent ransomware listing, this constitutes an actionable intelligence item requiring immediate incident-response evaluation rather than continued monitoring. Immediate priorities include auditing mail system access logs for anomalous activity, enforcing MFA on email and all identity infrastructure, and monitoring for unusual data exfiltration patterns. Healthcare organizations in Malaysia should treat this combination as requiring immediate incident-response evaluation, and continued dark web and stealer-log monitoring remains advisable to detect further exposure.