Hollysys Asia Pacific Listed by crypto24 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware operations targeting industrial and infrastructure providers have become a persistent feature of the threat landscape, with groups routinely claiming to compromise organizations that support transportation and manufacturing systems. On December 1, 2025, the crypto24 ransomware group listed Hollysys Asia Pacific on its leak site and stated that it had exfiltrated internal files during a ransomware attack. The number of individuals affected remains unknown, and no further details on the scale or timing of the intrusion have been made public.

Inside the incident

The only confirmed information is the listing itself. The group claims to have obtained internal files, but no file counts, specific dates of access, or descriptions of the data have been released by either the organization or the group. Hollysys Asia Pacific has not issued a public statement confirming or denying the claims at the time of reporting.

The group behind it: crypto24

Crypto24 is a ransomware operator that follows the common pattern of encrypting systems and then posting claims of data theft on a dedicated leak site when ransom demands are not met. Such groups typically gain initial access through phishing, compromised remote access services, or supply-chain weaknesses before moving laterally inside target networks. The listing of Hollysys Asia Pacific constitutes the group’s claim of responsibility; independent confirmation of the data’s authenticity or volume has not been provided.

Hollysys Asia Pacific and its sector

Hollysys Asia Pacific operates as part of Hollysys Automation Technologies Ltd, which supplies industrial automation, rail transportation control systems, and mechanical and electrical solutions. Organizations in this sector design and maintain systems used in manufacturing plants, rail signaling, and other operational technology environments. These entities routinely hold engineering specifications, project documentation, vendor contracts, and internal communications that support critical infrastructure projects.

What was likely exposed

The facts state that internal files were exfiltrated. No further breakdown of file categories or data fields has been disclosed. Organizations of this type commonly store technical drawings, control-system configurations, employee records, and commercial agreements; however, the precise contents of the claimed exfiltration remain unconfirmed.

What's at stake

Exposure of internal operational documents can create downstream risks for clients and partners who rely on the confidentiality of engineering and project data. For individuals whose information appears in those files, potential consequences include targeted phishing or misuse of credentials. For the organization, the incident may affect relationships with rail and industrial customers that require assurance of supply-chain security.

Were you affected?

Because the number of individuals involved is unknown, anyone who has conducted business with Hollysys Asia Pacific or its parent company should monitor their email and accounts for unusual activity. A practical first step is to review recent login attempts and enable multi-factor authentication on any associated services. Readers can also run a free exposure scan of their email address against known breach data to check whether their information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.