Mah Sing Group Data Breach

Scarlettgroup added Mah Sing Group to its dark web portal on October 26, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. Mah Sing Group is a hospitality-sector organization based in Malaysia. The listing follows the group’s demonstrated focus on hospitality targets in this period, and the exposure of corporate authentication credentials for the organization in underground circulation may explain why this victim fits the group’s recent targeting pattern. Scarlettgroup claimed 3 other victims in the prior 60 days. Its sector concentration during this period spans Hospitality, Professional Services, and Other, with a geographic focus on Malaysia, Indonesia, and Singapore, indicating consistent regional targeting. Recent overlap victims include VinSolutions and Yale University Press. Mah Sing Group fits Scarlettgroup’s demonstrated focus on hospitality targets in this period, and its Malaysian base aligns directly with the group’s regional focus.

SOCRadar’s stealer-log query for mahsing[.]com.my returned 13 records. All were classified as INTERNAL_AUTH_EMPLOYEE (category A) — corporate authentication credentials for Mah Sing Group employees in active underground circulation. The date range spans December 2024 through September 2026, a 21-month harvest window. This pattern indicates that credentials were either not rotated or re-harvested repeatedly after rotation. Category A credentials are the primary initial-access pathway into Microsoft 365, VPN, and SSO portals — exactly the entry points ransomware operators and initial access brokers exploit before deployment. The data pattern here is consistent with pre-positioning ahead of the Scarlettgroup listing. This does not prove that this specific access method was used in the incident, but the presence of long-lived corporate authentication credentials in active circulation is consistent with the intrusion pathways ransomware operators typically pursue, and the extended harvest window suggests sustained credential availability rather than a single isolated exposure. Immediate actions: rotate credentials for all flagged accounts. Audit the M365 tenant and VPN logs for unauthorized sessions. Initiate an endpoint threat hunt. Assess notification obligations if customer data is within reach of compromised systems. Continued dark web and stealer-log monitoring is advised to detect any further exposure of corporate credentials or alternate domains associated with the organization.