AFWorkshop listed on Deadlock ransomware leak site

• Ransomware group: Deadlock
• Country: Singapore
• Sector: Professional Services
• Announcement date: July 10, 2026

The Singapore-based architecture and design firm AFWorkshop has been listed on the leak site associated with the Deadlock ransomware group. The threat actor, operating under the name Deadlock, has published an announcement claiming that the organization's data has been compromised. This announcement was made on July 10, 2026, the same date the group claims the attack occurred.

The claims made by Deadlock

The threat actor known as Deadlock has officially listed the AFWorkshop organization on its dedicated leak platform. According to the group's announcement, the organization's data has been successfully compromised. However, technical examination of the provided evidence reveals inconsistencies in the claim. The screenshot provided by the threat actor shows that the relevant directory on the leak site is currently empty and returns an HTTP 403 error, suggesting that no files are currently accessible through that specific link.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers do not merely encrypt an organization's local files to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release this information publicly, the attackers aim to exert maximum pressure on the victim to meet ransom demands. The use of leak sites serves as a public shaming mechanism intended to damage the reputation of the target organization and force compliance.

Details regarding the alleged data leak

At this stage, there is no information regarding the nature of the data allegedly leaked by the Deadlock group. The provided screenshot does not display any content related to the data, nor does it provide a list of specific files or directories that have been exfiltrated. Consequently, the listing names no specific data types.

Potential risks of data exposure

While the specific content remains unknown, the claim that an organization's data has been leaked poses significant secondary risks. If sensitive information is indeed compromised, it can lead to identity theft or targeted phishing attacks directed at the organization's employees and customers. Such attacks often use stolen credentials or personal details to gain further access to corporate networks or to defraud individuals.

About AFWorkshop

AFWorkshop is an international architectural and design firm based in Singapore. The company has been operating since 2004 and is characterized as a multi-disciplinary practice. The firm handles a wide variety of projects, ranging from large-scale developments to boutique projects, serving clients across Asia and other international regions.

Analysis and organizational implications

Public information regarding the Deadlock ransomware group remains limited, making it difficult to assess their specific tactics, techniques, and procedures. Because the scale and content of the alleged leak have not yet been clarified, the total impact on AFWorkshop's operational continuity remains unknown. It is possible that the threat actor is using this announcement primarily as a method to exert pressure on the organization.

From a regulatory perspective, the situation may trigger legal obligations. Under Singapore's Personal Data Protection Act (PDPA), the organization may face mandatory data breach notification requirements if the incident involves personal data. Organizations in the professional services sector should remain vigilant following such claims. Common defensive steps for organizations facing potential extortion include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of phishing.