RDC Architects listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Singapore
• Sector: Professional Services
• Announcement date: January 27, 2025

Qilin ransomware group targets RDC Architects

The threat actor known as Qilin has officially listed RDC Architects on its dedicated leak site. According to the announcement made on January 27, 2025, the group claims that the company's data is at risk of being published. This development follows a period of reconnaissance that the group alleges was conducted on January 27, 2025. The threat actor has set a deadline, claiming that the company's data may be released to the public on February 2, 2025.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These sites often host lists of compromised organizations and, in some cases, provide samples of stolen data to prove the validity of the breach. This tactic is a core component of modern cyber extortion, where the threat of public exposure is used as leverage against the victim organization.

Details of the alleged data breach

As part of the announcement on the leak site, the Qilin group has shared samples of various files that they claim belong to the architectural and design operations of RDC Architects. The provided screenshots and samples allegedly include sensitive documentation that could impact the firm's business and privacy. The specific types of data mentioned in the listing include:

• Architectural drawings
• Technical documents
• Identity information

The presence of identity-like documents among the shared samples suggests that the breach may involve personal information. In many ransomware attacks, the goal is not just to encrypt systems but to exfiltrate sensitive files that can be used for further exploitation or public shaming.

The organization profile

RDC Architects is an architecture and design firm based in Singapore. The company provides architectural projects and engineering services across various scales, serving a diverse range of client needs within the professional services sector.

Implications and risks of the attack

The Qilin group frequently employs a double extortion method. In this scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. If the ransom is not paid, the group's past activities suggest that the stolen data may be made publicly available, leading to significant consequences for the victim.

For a company operating in Singapore, the potential leak of sensitive data could trigger legal processes under the Personal Data Protection Act (PDPA). Furthermore, the disclosure of architectural projects may create long-term commercial risks for the company regarding intellectual property rights. The inclusion of identity-like documents in the leaked samples also poses a heightened risk of identity theft for both employees and clients of the firm.

The impact of such an event can be categorized into several areas of risk:

• Reputational damage: The public disclosure of sensitive client projects and internal documents can erode trust with stakeholders.
• Operational disruptions: Ransomware attacks often lead to significant downtime and the inability to access critical design and engineering files.
• Legal and regulatory risks: Compliance with local data protection laws is a major concern when personal information is compromised.
• Intellectual property risks: The exposure of proprietary architectural drawings and technical specifications can harm competitive advantages.

Organizations in the professional services sector can take various defensive steps to mitigate these risks. Implementing robust data encryption, maintaining offline backups, and enforcing strict access controls are standard industry practices. Additionally, organizations should focus on employee training to prevent initial access via phishing and should have a well-defined incident response plan to manage the complexities of a potential data leak or double extortion attempt.