RansomHub ransomware group lists lianbeng.sg on its leak site

• Ransomware group: RansomHub
• Country: Singapore
• Sector: Professional Services
• Announcement date: January 1, 2025

RansomHub claims to have compromised Lian Beng Group data

The ransomware group known as RansomHub has listed the Singapore-based organization lianbeng.sg on its leak site. In an announcement published on January 1, 2025, the threat actor alleged that the organization's data has been compromised. This incident follows a pattern often seen in modern cyberattacks, where threat actors utilize leak sites to exert pressure on victims through the threat of public data exposure.

The threat actor claims to possess sensitive information belonging to more than 1500 employees of the organization. This alleged breach highlights the ongoing risks faced by large-scale enterprises by sophisticated ransomware groups that specialize in data exfiltration and extortion.

Details of the alleged data theft

According to the announcement made by RansomHub, the stolen information is extensive and covers both personal and corporate information. The group claims to have access to a wide variety of sensitive documents that could impact the privacy of individuals and the operational security of the company. The specific types of data mentioned in the claim include:

• Employee identity data
• Passport information
• Insurance records
• Bank statements
• Corporate emails
• Financial data
• Project and tender documents

While the specific volume of the data and the exact file count have not been disclosed by the group, the breadth of the categories suggests a significant breach of sensitive information.

About Lian Beng Group

Lian Beng Group is a Singapore-based holding company that maintains a significant presence in several key industries. The company operates extensively within the construction, property development, and investment sectors. As a major player in the region, the company provides essential engineering and construction services for a variety of projects across both the public and private sectors.

Impact and security implications

The alleged leak of this information presents several critical risks. The exposure of employee identification details, such as NRICs and passport information, poses a severe risk of identity theft for the affected individuals. Furthermore, the publication of an organization's financial and operational data, including project and tender documents, could lead to a significant loss of commercial reputation and create a competitive disadvantage in the marketplace.

Given that the organization operates in Singapore, it may face legal sanctions under the Personal Data Protection Act (PDPA) due to the potential exposure of personal data. This highlights the regulatory complexities and legal liabilities that organizations face following a data breach.

RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. The group gained notoriety for absorbing affiliates from ALPHV. Reports indicate that the group may have ceased operations in early 2025, which suggests that this specific leak may have occurred during the final stages of the group's operational period.

In general, organizations in the construction and professional services sectors can mitigate such risks by implementing robust security frameworks. Defensive steps often include maintaining strict access controls, implementing multi-factor authentication, and conducting regular audits of sensitive data repositories. Additionally, ensuring comprehensive encryption for data at rest and in transit can help protect information even if a perimeter is breached.