Hollysys Asia Pacific listed on crypto24 leak site

• Ransomware group: crypto24
• Country: Singapore
• Sector: Technology
• Announcement date: December 1, 2025

Hollysys Asia Pacific targeted by crypto24

Hollysys Asia Pacific has been listed on a leak site by the threat actor group known as crypto24. The group claims to have successfully targeted the organization and obtained data belonging to the entity.

Details of the claim

The threat actor group crypto24 listed Hollysys Asia Pacific on their leak site on December 1, 2025. According to the announcement, the group claims to have obtained data belonging to the organization. While the listing confirms the target, public information regarding the specific activities and identity of the crypto24 group remains limited.

Ransomware leak sites are platforms used by cybercriminals to exert pressure on victims. These sites serve as a public gallery where threat actors post names of organizations they have successfully breached. By listing a company, the attackers aim to damage the victim's reputation and create public pressure to fulfill ransom demands. This tactic is a core component of modern cyber extortion campaigns.

Data involved in the incident

Regarding the specifics of the alleged breach, there is no screenshot or detailed information provided regarding the nature of the data allegedly leaked. The listing does not specify any particular categories of information or the volume of files involved.

About Hollysys Asia Pacific

Hollysys is a global technology company providing industrial automation, control systems, and energy management solutions. It specializes in developing critical infrastructure automation technologies for the energy, rail, and industrial sectors.

Potential impact and risks

This claim may lead to disruptions in the organization's operational processes and could potentially impact corporate reputation. Depending on the content of the leaked data, secondary risks such as identity theft and targeted phishing attacks may emerge if employee or customer information is exposed. As the organization is based in Singapore, it is considered that the incident may trigger legal obligations under the PDPA (Personal Data Protection Act).

If the threat actor employs double extortion tactics, there may be a possibility that the organization is pressured to pay a ransom or that the data is shared with a wider audience. Double extortion is a strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This creates a dual pressure point: the need to restore systems and the need to prevent the exposure of confidential data.

In sectors involving critical infrastructure and industrial automation, such as the energy and rail sectors, the implications of a breach can be significant. Organizations in these sectors often focus on robust defensive measures to protect both their internal networks and the industrial control systems they manage. Common defensive steps for organizations include maintaining rigorous patch management, implementing multi-factor authentication, and conducting regular security awareness training to mitigate the risk of phishing. Furthermore, maintaining offline backups and implementing network segmentation are standard practices used to limit the lateral movement of attackers within a network.