Haworth Tompkins Listed by royal Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In late May 2023, the architectural studio Haworth Tompkins appeared on a listing associated with the royal ransomware group, which claimed to have taken internal files during an attack. For anyone who has worked with, been employed by, or otherwise shared information with the firm, the practical question is straightforward: whether personal or project-related data left the organisation’s control and what that could mean in everyday terms.

Public detail remains limited. The number of people affected is unknown, and the precise contents of the material have not been independently confirmed. What is reported is that the group claimed roughly 100 GB of internal files were exfiltrated. That claim alone is enough to warrant careful attention from those who may be connected to the studio.

What happened

According to reporting dated 26 May 2023, Haworth Tompkins was listed by the royal ransomware group. The available summary states that internal files were exfiltrated in a ransomware attack and that the total volume of downloaded data claimed by the group was 100 GB. No further verified particulars—such as the exact date of intrusion, the initial access method, whether systems were encrypted, or any negotiation—have been disclosed in the material provided. The scale of impact on individuals is recorded as unknown. The listing itself constitutes a claim by the group rather than an independently verified confirmation of every asserted detail.

The group behind it: royal

Royal is a ransomware operation that became active in the public eye around 2022. Like many contemporary groups, it has typically followed a double-extortion model: encrypting systems where possible while also copying data and threatening to publish or sell it if demands are not met. The group has been observed using leak sites to name organisations and to post samples or larger archives as pressure tactics. Its operators have targeted a range of sectors rather than specialising in one industry. In this instance, the sole specific assertion tied to Haworth Tompkins is the group’s own listing and the accompanying claim of approximately 100 GB of internal files. No additional statements attributed to royal about this particular victim appear in the given facts, and the listing should be treated as an unverified claim pending further confirmation.

Who is Haworth Tompkins?

Haworth Tompkins is a Stirling Prize-winning architectural studio known for intelligent, purposeful design and an international reputation. Architectural practices of this kind routinely handle project documentation, client correspondence, contracts, financial records, employee information, and sometimes sensitive details about buildings, sites, or collaborators. A breach involving such a firm is consequential because the data can touch clients, staff, contractors, and partners across multiple projects and jurisdictions. Even when the exact files remain unconfirmed, the nature of the work means that both professional and personal information can be present in internal systems.

What was likely exposed

The facts state that internal files were exfiltrated and that the group claimed a total of 100 GB. No itemised list of data types—such as names, contact details, financial records, or project files—has been disclosed beyond the general description of internal files. Organisations in the architectural sector commonly hold employee records, client and supplier details, design documents, contracts, and administrative correspondence. It is reasonable to note that material of those kinds could be among internal files, yet it is not established as fact that any specific category was present in the taken data. The exact contents remain unconfirmed.

What's at stake

For individuals, the main risks are practical rather than abstract. If contact details, identification documents, or financial information were included, those could be misused for phishing, impersonation, or fraud. Project-related material might expose commercial or personal information about clients and collaborators. For the studio itself, the stakes include operational disruption, potential regulatory notification duties, reputational questions from clients and partners, and the cost of investigation and remediation. Because the number of people affected is unknown and the file contents are not publicly itemised, the concrete exposure for any single person cannot be stated with certainty; the prudent approach is to assume that relevant internal data may have left the organisation’s control until clearer information emerges.

If your data was in this claimed breach

If you have a past or present connection to Haworth Tompkins—as staff, client, or collaborator—treat the possibility of exposure seriously but calmly. Monitor financial and email accounts for unusual activity, be wary of unexpected messages that reference the firm or its projects, and consider placing fraud alerts with relevant services if you believe sensitive personal data could be involved. Change passwords on any accounts that may have shared credentials or recovery information with work systems, and enable multi-factor authentication where it is available. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets; that step provides one additional data point without cost. Keep records of any suspicious contact and report confirmed misuse to the appropriate authorities. Further official statements from the organisation, if issued, should be read carefully for specific guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.