AFWorkshop Listed by Deadlock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional services firms as part of a broader pattern of attacks on organisations that hold project documentation and client records. On 10 July 2026 the Deadlock group listed AFWorkshop on its leak site, claiming to have exfiltrated internal files during a ransomware operation against the Singapore-based firm.

The number of individuals affected remains unknown, and the firm has not issued a public statement confirming the incident or the extent of any data access. The listing adds AFWorkshop to a growing list of design and construction-related entities that have appeared on such sites in recent years.

What happened

The Deadlock ransomware group listed AFWorkshop on its leak site on 10 July 2026. The group claims that internal files were exfiltrated during the operation. No further details on the timing of the intrusion, the volume of data, or the method of initial access have been made public.

The number of people whose information may be involved is not stated in available reports. The firm, previously known as Andy Fisher Workshop, has not confirmed or denied the claims at the time of reporting.

The group behind it: Deadlock

Deadlock is a ransomware operation that maintains a leak site to publish data it claims to have taken from targeted organisations. Like other groups in this category, it typically pairs file encryption with the threat of data publication to pressure victims.

The group’s listings are presented as claims by the operators themselves. Independent confirmation of the data’s authenticity or the circumstances of its acquisition is not available from the listing alone.

AFWorkshop and its sector

AFWorkshop is an international architectural and design practice headquartered in Singapore. Established in 2004, the firm undertakes both large-scale and smaller projects across Asia and other regions, working with clients in the built-environment sector.

Organisations of this type routinely handle project drawings, client correspondence, contracts, and technical specifications. A breach at such a firm can therefore involve material that extends beyond the company itself to its clients and project partners.

What was likely exposed

The only data category named in connection with the incident is internal files exfiltrated during the ransomware attack. No inventory of specific file types or record categories has been released.

Architectural and design practices commonly store client details, site plans, financial documents related to projects, and internal communications. The precise contents of the exfiltrated material remain unconfirmed.

The real-world impact

Exposure of project documentation can create follow-on risks for clients, including the potential use of design information by unauthorised parties or complications in ongoing commercial arrangements. For individuals whose personal details appear in internal records, the main concerns are increased exposure to targeted phishing or account misuse.

For the organisation, the incident adds administrative and reputational costs associated with investigation, client notification, and any required security improvements. The absence of Reported Details on the scale of the data limits a full assessment of downstream effects at this stage.

If your data was in this claimed breach

Individuals who have worked with AFWorkshop or similar firms should monitor their email and financial accounts for unusual activity and consider enabling multi-factor authentication on any services linked to project correspondence. Changing passwords for accounts that may share credentials with the firm is a prudent first step.

Readers can run a free exposure scan of their email address against known breach data to check whether their information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.