MARDEC Berhad Data Breach

Orova listed MARDEC Berhad on its dark web leak portal on November 3, 2026, and the listing was identified through SOCRadar Dark Web Monitoring. MARDEC Berhad is a Malaysian natural rubber processor and industrial materials manufacturer, placing the alleged incident squarely within the manufacturing sector. The company’s role in industrial supply chains is worth weighing: a compromise at this level can carry upstream and downstream implications beyond the initial victim, which makes the claim relevant not only to MARDEC itself but also to the partners connected to its operations. The listing fits a visible pattern in Orova’s recent activity. Over the past 60 days, the group has claimed 17 other victims, with manufacturing now a growing share of its targets alongside its core Technology, Other services, and Hospitality focus. Malaysia recurs in the same window: other Malaysian victims include Bright Property Service (Professional Services), Alfameli Group, and Wah Chan Consolidated Sdn Bhd. MARDEC therefore aligns with both the geographic and sectoral trends in Orova’s recent targeting, indicating that Malaysian industrial and manufacturing organizations are an active part of the group’s current victim set.

SOCRadar’s stealer-log telemetry for the domain mardec[.]com.my returned nine records. The breakdown spans three categories: five category A records consisting of direct employee credentials, primarily corporate email addresses exposed against the organization’s webmail at webmail.mardec[.]com.my; two category B records from external users or customers on organization-owned systems; and one category C record showing a corporate user accessing a third-party supply-chain SaaS linked to a major Malaysian rubber manufacturing conglomerate. The freshness window runs from December 2025 through September 2026 — nine months of credential exposure against the company’s mail server with no apparent rotation. That pattern is consistent with sustained harvesting from compromised employee endpoints rather than a one-time scrape. The stealer-log finding is significant in the context of a ransomware claim: corporate credentials harvested against the organization’s webmail and left unrotated could offer a path into corporate systems, although the telemetry does not confirm that Orova used these records, and the listing remains an alleged claim rather than an independently verified breach. The category C record stands out given MARDEC’s industrial footprint: a corporate credential for a third-party supply-chain SaaS tied to a major Malaysian rubber manufacturing conglomerate could extend exposure beyond MARDEC’s own perimeter. The two category B records add external-user credentials on organization-owned systems. The report pairs the telemetry with specific response steps. Notify the upstream supply-chain SaaS partner about the category C record so the linked account can be assessed on the conglomerate side. Force credential rotation for all accounts in the sample, prioritizing the five category A corporate email credentials against webmail.mardec[.]com.my. Audit webmail.mardec[.]com.my authentication logs for the full December 2025–September 2026 window to check for successful use of the exposed credentials. Finally, check for endpoint compromise on the workstations associated with the harvested credentials, since the nine-month harvesting pattern points to compromised employee endpoints rather than a single collection event.