WOHA listed on lamashtu ransomware leak site

• Ransomware group: lamashtu
• Country: Singapore
• Sector: Hospitality
• Announcement date: May 6, 2026

Lamashtu claims data breach against WOHA

The lamashtu ransomware group has listed the Singapore-based architectural firm WOHA on its dedicated leak site. According to the group's announcement, which was posted on May 6, 2026, the attackers claim to have successfully exfiltrated approximately 25 GB of data belonging to the organization. This announcement follows a claimed attack date of May 6, 2026.

The group has listed a total of 12,000 files on its leak site, which it asserts are associated with WOHA. The announcement alleges that the stolen data spans a significant timeframe, covering records from 2017 through 2026. While the group has made these claims, public information regarding the specific identity and operational details of the lamashtu group remains limited.

Details of the claimed data theft

The content of the alleged breach is extensive, involving various types of sensitive corporate and personal documentation. The lamashtu group claims that the stolen information includes a wide array of files critical to the firm's operations and administrative functions. The specific categories of data identified in the claim include:

• Project documentation
• Construction drawings
• Salary records
• Financial records
• Personnel data

Beyond these specific categories, the group's announcement also mentions the inclusion of tender submissions, invoices, cost estimates, ISO 9001 audit documents, and correspondence with government authorities. This breadth of data suggests a significant breach of the organization's internal repositories.

About WOHA

WOHA is a renowned Singapore-based architectural practice. Founded in 1994 by Wong Mun Summ and Richard Hassell, the firm has achieved global recognition for its unique approach to design. The firm is specifically noted for its integration of environmental and social principles into high-density urban settings, making it a significant player in the global architectural landscape.

Potential impact and strategic risks

The exposure of this data carries several significant risks for the organization. The leak may lead to the exposure of personal data belonging to WOHA employees, potentially resulting in privacy violations. Furthermore, the theft of such a vast amount of documentation could result in direct damage to the firm's corporate intellectual property. Because the group appears to be utilizing double extortion tactics—a method where attackers both encrypt data and threaten to leak it—the publication of this information could lead to significant corporate reputational damage.

From a legal and strategic perspective, the firm may face legal sanctions under Singapore's Personal Data Protection Act (PDPA) due to the nature of the exposed information. Additionally, the disclosed financial and project data could pose a strategic risk to the firm's competitive position. Such information could also be leveraged by malicious actors to facilitate targeted phishing attacks against the firm's third-party partners and clients.

In general, when organizations face such threats, defensive measures often include implementing robust data encryption, enforcing multi-factor authentication, and maintaining rigorous backup protocols. Ransomware leak sites serve as a platform for extortion, where groups use the threat of publicizing sensitive information to pressure victims into paying ransoms. The complexity of these attacks highlights the ongoing need for comprehensive cybersecurity frameworks to protect intellectual property and sensitive personnel information.