Disk Precision Group listed on LeakBazaar leak site
Singapore-based manufacturing firm Disk Precision Group has been listed on a leak site by the threat actor known as LeakBazaar. It is claimed that approximately 80 GB of sensitive data belonging to the organization has been exfiltrated.
- Published
- 3 min read
- 3 min read
- Ransomware group: LeakBazaar
- Country: Singapore
- Sector: Manufacturing
- Announcement date: May 10, 2026
LeakBazaar claims data breach against Disk Precision Group
The threat actor known as LeakBazaar has listed the Singapore-based manufacturing firm Disk Precision Group on its leak site. According to the claims made by the threat actor, approximately 80 GB of sensitive data belonging to the organization has been exfiltrated. This announcement, made on May 10, 2026, suggests that the alleged attack occurred around April 25, 2026.
Ransomware groups often utilize leak sites to increase pressure on their victims through a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems but also steal sensitive information. If the ransom is not paid, the threat actors threaten to publish the stolen data publicly to cause reputational and operational damage. While the specific ransom demand for this incident has not been disclosed, the presence of the organization on a leak site is a significant indicator of a potential security incident.
Details of the alleged data exfiltration
The LeakBazaar group has published data they claim belongs to Disk Precision Group on their leak site. The threat actor states that they have categorized the stolen data into ten distinct sections intended for sale. The alleged exposure includes a wide variety of corporate documents that could provide deep insight into the company's internal operations and business relationships.
The content of the alleged leak is reported to include various sensitive documents. Specifically, the data is said to consist of:
- Financial data
- Supplier information
- Customer information
- Production cost reports
- Security reports
The threat actor claims the stolen material encompasses guidance documents, research reports, sanction information, supplier and buyer lists, production cost calculations, quarterly reports, and other confidential data. It is important to note that the specific file count and the exact ransom amount requested have not been provided by the threat actor.
About Disk Precision Group
Disk Precision Group is a Singapore-based industrial company specializing in CNC machining, fabrication, and precision engineering solutions. The organization focuses on manufacturing high-precision components for various critical industries, including the aerospace, medical, and automotive sectors. Given the high-precision nature of their work, the company operates within highly regulated and technically demanding environments.
Potential implications and industry considerations
If the leak claim is verified, the exposure of Disk Precision Group's trade secrets and financial data could harm the organization's competitive position. The disclosure of supplier and customer information may increase third-party risks and potentially facilitate supply chain attacks, where attackers leverage information about one company to target its partners. Furthermore, the organization could face legal sanctions under Singapore's data protection regulations (PDPA).
The stolen data might also be utilized in secondary attacks or identity theft attempts. For organizations operating in the manufacturing and precision engineering sectors, such breaches highlight the importance of robust data protection strategies. Common defensive steps for organizations include implementing strict access controls, maintaining comprehensive logging and monitoring, and ensuring regular, offline backups of critical systems. Protecting intellectual property and sensitive client lists is vital for maintaining trust within complex industrial supply chains.
Information regarding the LeakBazaar group remains limited, making it difficult to attribute the attack or understand their specific methodologies. As with all leak site announcements, the claims made by the threat actor must be treated as unverified until a formal investigation or confirmation is provided.