Greyform.sg listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Singapore
• Sector: Professional Services
• Announcement date: January 15, 2025

The Safepay ransomware group has listed the Singapore-based organization greyform.sg on its dedicated leak site. This announcement, made on January 15, 2025, indicates that the threat actor claims to have compromised the organization's data through a ransomware incident.

The claimed incident

According to the announcement posted by the Safepay group, the alleged ransomware attack took place on January 15, 2025. The threat actor claims that the organization's data was compromised during this event. Such listings on a leak site are often characteristic of double-extortion tactics, a method where cybercriminals not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage for further ransom demands.

In a double-extortion scenario, the attackers threaten to release the stolen data publicly if the ransom is not paid. This tactic increases the pressure on the victim organization by threatening their reputation and legal standing. While the listing serves as a claim by the Safepay group, it highlights the ongoing trend of ransomware actors moving beyond simple encryption toward data exfiltration and public shaming.

Data involved in the claim

Regarding the specific details of the breach, the group has not provided any information regarding the nature of the leaked or threatened data. The listing shows the organization's name, but there is no detailed description of the content that has allegedly been stolen or is being held for ransom. Consequently, the listing names no specific data types.

About greyform.sg

Greyform is a professional services firm located in Singapore. The company specializes in the construction and engineering sectors, specifically providing expertise in reinforced concrete structures and formwork systems. As a provider of specialized engineering services, the organization operates within a sector that relies on technical precision and professional trust.

Risk assessment and implications

The announcement by the Safepay group may pose a significant risk to the operational continuity of greyform.sg. Allegations of a data breach can trigger a variety of secondary risks, including the potential for identity theft or highly targeted phishing attacks directed at the organization's customers and employees. When sensitive corporate or personal information is compromised, attackers often use it to conduct social engineering campaigns to further penetrate the network or defraud stakeholders.

Furthermore, because the organization is based in Singapore, a confirmed data breach could lead to significant legal obligations under the Personal Data Protection Act (PDPA). Organizations must be aware that regulatory frameworks in many jurisdictions impose strict requirements regarding the notification of breaches and the protection of personal information.

Given the group's use of double-extortion methods, there is a persistent risk that the allegedly compromised data could be published on the internet in the future. Such an event could lead to substantial reputational damage and the erosion of trust within the professional services and engineering sectors. To mitigate such risks, organizations typically focus on robust backup strategies, network segmentation, and continuous monitoring to detect unauthorized access early.