Koh Brothers Listed by lorenz Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to treat mid-sized industrial and construction firms as high-value targets, relying on double-extortion tactics that pair system encryption with the threat of public data leaks. In this environment, a listing on a criminal leak site can surface long before any official confirmation, leaving employees, partners and customers uncertain about what may have been taken.

On 2 November 2023, the Singapore-based construction and engineering firm Koh Brothers appeared on the leak site operated by the lorenz ransomware group. The group claims to have stolen internal data. Public detail remains limited: the number of people affected is unknown, and no independent confirmation of the intrusion or the precise contents of any exfiltrated material has been released.

Inside the incident

According to the available record, Koh Brothers was listed on the lorenz ransomware leak site on or around 2 November 2023. The group asserts that it conducted a ransomware attack and exfiltrated internal files. No further technical particulars—such as the initial access vector, the duration of any intrusion, the volume of data removed, or whether systems were encrypted—have been disclosed in the public summary. The number of individuals potentially affected is listed as unknown. At present the incident rests on the group’s own claim; no separate verification from the company or from independent investigators has been included in the reported facts.

The group behind it: lorenz

Lorenz is a ransomware operation that has been active for several years and is known for double-extortion methods. After gaining access to a network, the group typically steals data before deploying encryption, then pressures the victim by threatening to publish the stolen material on its dedicated leak site if a ransom is not paid. Lorenz has previously targeted organisations across manufacturing, professional services and other sectors, often posting sample files or directories to demonstrate possession. Listings on its site are claims made by the operators themselves; they do not automatically constitute proof that every asserted file was taken or that every named organisation suffered the full impact described. In this case, the only specific assertion tied to Koh Brothers is that internal data was stolen.

Koh Brothers and its sector

Koh Brothers is a construction and civil-engineering company headquartered in Singapore, with activities that commonly include building, infrastructure and related project work. Firms in this sector routinely hold project documentation, supplier and subcontractor records, financial and contractual information, employee data, and sometimes client or site-related personal details. A breach affecting such an organisation can therefore reach beyond the company itself to partners, workers and, in some cases, members of the public connected to projects. Because construction firms often operate complex supply chains and multi-party contracts, the compromise of internal files can create ripple effects across commercial relationships and regulatory obligations even when the exact scope of exposure remains unclear.

The information in question

The reported facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data categories—such as employee records, financial documents, customer information or technical drawings—has been published. Organisations of this type typically maintain a mixture of corporate, project and personnel data; however, the exact contents of any material claimed by lorenz remain unconfirmed. Until a fuller accounting is provided by the company or by investigators, it is not possible to state with certainty what types of information, if any, left the organisation’s control.

What's at stake

For individuals whose details may have been among the internal files, the practical risks include potential misuse of personal or contact information, targeted phishing that references genuine project or employment details, and longer-term exposure if identity or financial data were present. For Koh Brothers, the consequences can include operational disruption, contractual and regulatory scrutiny, reputational damage with clients and partners, and the cost of investigation and remediation. Because the scale of the incident and the precise data involved are undisclosed, the full extent of these risks cannot yet be measured. Both the organisation and any affected parties are left to operate on incomplete information until more definitive details emerge.

Were you affected?

If you have a past or present connection to Koh Brothers—as an employee, contractor, supplier or client—monitor financial and email accounts for unusual activity and treat unsolicited messages that reference the company or its projects with caution. Consider changing passwords on any accounts that may have shared credentials or recovery information linked to work systems. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Official updates, if and when they are issued by the company, remain the most reliable source of confirmation about the scope of this incident.

AICompiled with AI assistance from public sources and published under our editorial standards.