AirAsia ransomware attack (Daixin Team)

In November 2022, the low-cost carrier AirAsia — operated by Malaysia-based Capital A Berhad — was struck by the Daixin Team ransomware gang, which claimed to have stolen the personal data of roughly 5 million unique passengers and all of the airline's employees.

What happened

According to Daixin Team, the group breached AirAsia's network over 11–12 November 2022. The attackers said they exfiltrated two large data sets before locking access to staff and passenger records. On 19 November, the breach surfaced publicly through DataBreaches.Net, and on 21 November Daixin published sample files as proof.

Daixin Team is a financially-motivated ransomware-and-extortion group that the U.S. CISA and FBI had warned about earlier in 2022 for targeting the healthcare sector. The gang told reporters it avoided encrypting flight-equipment systems to prevent any life-threatening disruption, but fully locked out access to administrative records until payment.

Data exposed

• Passenger records (~5 million): passenger ID, full name (first, middle, last), booking ID, and total ticket cost.
• Employee records: name, date of birth, country of birth, work location, employment start date, and — notably — each employee's secret security question, the answer, and the password salt.

The exposure of security questions and answers was especially sensitive, as it could facilitate account-takeover and social-engineering attacks against staff.

Attacker commentary

In an unusually candid exchange, Daixin members criticised AirAsia's security posture, describing "the chaotic organisation of the network" and saying the sprawling, poorly-segmented internal infrastructure discouraged them from pursuing deeper attacks. They claimed AirAsia made no attempt to negotiate the ransom and showed no intention of paying.

Impact and response

AirAsia did not pay any ransom, and the stolen data was leaked. The Malaysian Personal Data Protection Department (JPDP), under the Ministry of Communications and Multimedia, opened an investigation into whether the carrier had breached the Personal Data Protection Act 2010. The incident drew criticism for the apparent weakness of AirAsia's network segmentation and credential-protection practices.

Why it matters

The AirAsia breach is a landmark Malaysian incident for two reasons. First, it exposed identity-grade data on millions of travellers and the entire workforce of one of Asia's largest budget airlines. Second, the attackers' public description of a "chaotic" network underscored a recurring theme in the region's major breaches: rich, centralised personal data stored on inadequately segmented and monitored systems. It reinforced the case for stronger breach-notification enforcement and aviation-sector cybersecurity standards across Southeast Asia.