SLA.DK listed on sinobi ransomware leak site

• Ransomware group: sinobi
• Country: Denmark
• Sector: Technology
• Announcement date: December 8, 2025

The sinobi ransomware group claims a breach of SLA.DK

The ransomware group known as sinobi has listed the Danish organization SLA.DK on its leak site. According to the announcement made on December 8, 2025, the group claims to have successfully exfiltrated 300 GB of data from the firm's systems.

Ransomware attacks often involve a technique known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption occurs. The attackers then threaten to publish this stolen data on a public leak site if the ransom is not paid. This tactic increases the pressure on the victim, as the threat of data exposure can cause significant reputational and legal damage, even if the organization has backups to restore its systems.

Details of the alleged attack and ransom demand

The sinobi group claims to have conducted a ransomware attack against SLA.DK on December 7, 2025. The group states that it has encrypted the organization's data and is demanding a ransom of 17.1 million dollars. The announcement alleges that financial and operational data belonging to the firm has been compromised during the incident.

While the specifics of the initial intrusion vector remain unknown, the group's high ransom demand suggests a focus on high-value corporate targets. Such significant demands are often seen when attackers believe they have accessed critical business information that is vital to the target's continued operations or market standing.

Data types allegedly involved in the leak

The leak is stated to consist of 300 GB of data. The group claims that the stolen information includes various categories of sensitive material that could impact the firm's internal operations and external relationships. The alleged data set includes:

• Financial data
• Customer data
• HR records
• Confidential documents

The exposure of such diverse data types—ranging from internal human resources records to client-facing information—presents a broad spectrum of risk to the organization and its stakeholders.

About SLA.DK

SLA is a multidisciplinary architectural lab focusing on urban space, city planning, and landscape architecture. With offices in Copenhagen, Aarhus, and Oslo, the firm develops projects addressing urban challenges, drawing inspiration from its Nordic roots to work on a global scale.

Potential impact and organizational risks

Given SLA.DK's operations in architecture and urban planning, the alleged exfiltration of data may negatively impact the firm's proprietary projects and trade secrets. The loss of confidential design documents or strategic planning data could undermine the firm's competitive advantage in the global architectural market.

Furthermore, as the organization is based in Denmark, this incident may trigger data breach notification requirements under the General Data Protection Regulation (GDPR). The exposure of financial and HR records could lead to secondary risks, such as identity theft or targeted phishing attacks against employees and clients. The risk extends beyond the organization itself, as supply chain partners and international projects may also be subject to indirect risks resulting from this potential breach.

In general, organizations facing such threats often prioritize incident response protocols, which include isolating affected systems to prevent further spread, conducting forensic investigations to determine the scope of the breach, and reviewing access controls. Strengthening defenses through multi-factor authentication, regular security awareness training, and robust data encryption are standard defensive measures used to mitigate the impact of such cyberattacks.