[ Ransomware claim · krybit · 24 Oct 2026 ]
mainplace.com.my
The ransomware group krybit named mainplace.com.my (Malaysia) on its leak site on 24 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
No public statement from Main Place or press report confirming a cyber incident in 2026 was found at the time of writing.
[ The organisation ]Who is mainplace.com.my?
- What it does
- Main Place is a neighbourhood shopping mall with an attached residential development in USJ 21, Subang Jaya. The four-storey mall houses shops in categories such as apparel, electrical appliances, grocery, food and beverage, toys, wellness and family activities. It was built on the site of a construction project that had been abandoned for more than a decade.
- Based in
- Jalan USJ 21/10, Subang Jaya, Selangor, Malaysia
- Founded
- 2014 (soft opening in March 2014)
- Size
- a four-storey mall with 130 shoplots, as reported at its opening
- Who it serves
- The mall serves shoppers and families from the surrounding USJ and Subang Jaya neighbourhoods, along with the retail and food businesses that rent its shoplots. Its residential section serves the people who live there.
Partners and customers it names publicly
- Jaya Grocer, tenant listed by Time Out in 2014
- Uniqlo, tenant listed by Time Out in 2014
- Cotton On, tenant listed by Time Out in 2014
[ Impact ]Who could be affected
An attack on a mall operator could disrupt car parking, payment, loyalty or building management systems used by shoppers and tenants. Tenants could see delays to billing or communication from the management office. Personal details held about tenants, residents, members or customers could be at risk if the claim is accurate.
In retail & e-commerce generally: Shoppers can face order delays and phishing that uses their order history, and online shops hold names, addresses and sometimes payment data.
[ The attacker ]About krybit
Krybit is a ransomware-as-a-service operation that appeared in early 2026, offering affiliates encryptors for Windows, Linux and VMware ESXi systems in return for a share of ransom payments. Security firms report that it uses double extortion, stealing data before encrypting systems and threatening to publish it.
krybit has claimed 7 organisations in the last 30 days, most in Austria, United States and Malaysia, and mostly in retail & e-commerce, manufacturing and transportation.
Other organisations krybit has named
- Austria
- United States
- Egypt
- Mexico
[ What to do ]If you are a customer, partner or neighbour
- If you are a tenant, confirm any request from the mall management to change payment details or rental accounts by phoning a known contact.
- Shoppers and loyalty or parking members should be wary of messages or calls claiming to be from Main Place that ask for personal or payment details.
- Residents should change any passwords used for the mall or residence portals and apps, especially if the same password is used elsewhere.
- Check the mall's official website and social media channels for any notice about the incident or affected services.