greyform.sg Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 15 January 2025, the Singapore construction firm greyform.sg appeared on a ransomware group's leak site, with the group claiming to have taken internal files. For employees, contractors, clients and partners whose details may sit inside those systems, the practical question is straightforward: whether personal or commercial information has left the company's control and what that could mean for identity misuse, fraud or competitive exposure. Public detail remains limited, so the scale and exact contents are not yet confirmed.

What is known so far is that the listing attributes the incident to the safepay ransomware group and describes internal files as having been exfiltrated. No figure for people affected has been released. Until more is verified, anyone connected to the firm has reason to treat the claim seriously and to take basic protective steps while waiting for clearer information.

What happened

According to the available record, greyform.sg was listed by the safepay ransomware group on 15 January 2025. The group claims that internal files were exfiltrated in a ransomware attack. No further technical detail—such as the precise method of initial access, the volume of data taken, encryption of systems, or any ransom demand—has been disclosed in the public summary. The number of people whose information may be involved is listed as unknown. The incident is therefore known only through the group's leak-site claim and the accompanying description of internal-file exfiltration; independent confirmation of the full scope has not been provided in the facts available.

Who is safepay?

Safepay is a ransomware operation that has been active in public reporting since roughly mid-2024. Like many contemporary groups, it is associated with double-extortion tactics: encrypting systems while also copying data and threatening to publish it if payment is not made. The group maintains a leak site where it posts victim names and, in some cases, sample files or full archives. Public accounts describe safepay as opportunistic rather than highly specialised, targeting organisations across multiple sectors and geographies. Its listings are claims made by the group itself; they are not independent verification that a breach occurred exactly as described or that every file listed was in fact taken. In this case the facts state only that greyform.sg was listed and that the group claims internal files were exfiltrated. No additional statements attributed specifically to safepay about this victim appear in the record.

greyform.sg and its sector

Greyform Pte Ltd, operating as greyform.sg, is a Singapore-based construction company that specialises in prefabricated construction methods. Public descriptions of the firm note a focus on sustainability and high-efficiency building techniques, covering design, production, logistics and installation of prefabricated components for residential, commercial and civil-engineering projects. Construction firms of this type routinely handle project plans, supplier contracts, employee and contractor records, client correspondence, financial documents and site-related operational data. A breach involving such an organisation is consequential because the sector sits at the intersection of commercial confidentiality, workforce personal data and, in some cases, information relevant to public infrastructure. Even when the precise files remain unconfirmed, the nature of the business means any successful exfiltration can affect multiple parties beyond the company itself—staff, subcontractors, clients and project partners.

The information in question

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No more granular inventory—such as employee databases, financial records, client lists, design drawings or credentials—has been disclosed. Organisations in the prefabricated-construction sector typically hold a mixture of personal data (names, contact details, identification or payroll information for staff and contractors), commercial documents (contracts, pricing, supplier details) and technical project material. Because the exact contents of the claimed exfiltration are unconfirmed, it is not possible to state which of these categories, if any, were involved. Readers should treat any specific data-type claims that appear outside the official record as unverified.

What's at stake

For individuals, the main risks are the usual consequences of personal or contact data leaving a trusted environment: targeted phishing, social-engineering attempts that reference real projects or colleagues, and, if identity documents or financial details were present, longer-term fraud exposure. For the organisation the stakes include potential disruption to operations, loss of commercial confidentiality around bids or designs, regulatory notification duties under Singapore’s personal-data protection framework, and reputational damage with clients and partners. Because the number of people affected is unknown and the file inventory is limited to the generic description “internal files,” the concrete impact cannot yet be quantified. The prudent assumption is that anyone whose information was stored in greyform.sg systems could be affected until the company or independent investigators provide clearer scope.

If your data was in this claimed breach

If you have worked for, contracted with, or supplied greyform.sg, treat the listing as a prompt to act rather than as proof that your own records were taken. Change passwords on any accounts that reused credentials associated with the company, enable multi-factor authentication where available, and watch for unexpected emails or calls that reference construction projects or internal contacts. Monitor bank and credit activity for unusual transactions. Keep records of any suspicious contact. You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach datasets; such a scan will not confirm or deny involvement in this specific incident, but it can surface other exposures that warrant attention. If greyform.sg issues official guidance or a notification, follow those instructions carefully. Public detail remains limited, so continued caution and basic hygiene are the most practical responses available at present.

AICompiled with AI assistance from public sources and published under our editorial standards.