Pelli Clarke Pelli Architects Listed by Booba Project Ransomware Group: What Was Exposed & What To Do

Ransomware groups continue to single out professional-services firms whose work depends on large volumes of project files, client records and internal planning material. Architecture practices sit in that category: they hold drawings, contracts and correspondence that are both commercially sensitive and, in many cases, tied to identifiable people. When a firm appears on a leak site, the listing itself becomes part of the public record even before independent confirmation is available.

On July 22, 2026, Pelli Clarke Pelli Architects was listed by the ransomware group known as Booba Project. The group claims to have exfiltrated internal files in a ransomware attack and describes the stolen material as architecture and planning data totaling 45 GB. The number of people affected has not been disclosed. Public detail remains limited to that claim and the reported summary of the incident.

Breaking down the breach

According to the available report, Pelli Clarke Pelli Architects was named on a Booba Project leak site on July 22, 2026. The listing characterises the event as a ransomware attack in which internal files were taken. The volume cited is 45 GB, described as architecture and planning material. No further technical detail—such as the initial access method, the duration of unauthorised access, encryption of systems, or any ransom demand—has been made public in the material provided.

The count of individuals whose information may be involved is unknown. There is no confirmed inventory of exact file types beyond the broad description of internal files and architecture and planning data. Until the organisation or independent investigators publish additional findings, the scale and precise contents of the incident rest on the group’s claim and the sparse reported summary.

The group behind it: Booba Project

Booba Project operates in the style of contemporary ransomware crews that combine data theft with the threat of publication. Groups of this type typically gain access to a network, move laterally, exfiltrate material they consider valuable, and then list the victim on a dedicated leak site to apply pressure. Publication of sample files or full archives is used as leverage when negotiations stall or when the operators wish to demonstrate capability.

Public reporting on Booba Project has associated the name with ransomware and data-leak activity against organisations across multiple sectors. Like other actors in this space, the group’s leak-site posts are claims: they assert that data was taken and often state a volume or category, but those assertions are not independently verified at the moment of listing. In this case, the group claims that architecture and planning data amounting to 45 GB was stolen from Pelli Clarke Pelli Architects. No additional statements from the group about this specific victim are reflected in the facts at hand.

About Pelli Clarke Pelli Architects

Pelli Clarke Pelli Architects is an architecture and planning practice. Firms of this kind design and manage complex building and urban projects for public and private clients. Their day-to-day work generates large collections of drawings, specifications, models, schedules, contracts, correspondence and project-management records. Those materials often include names, contact details and organisational affiliations of clients, consultants, contractors and staff, as well as commercially sensitive design and cost information.

A breach at such a practice matters because the data is both operationally critical and personal. Loss or exposure can disrupt ongoing projects, reveal competitive or security-sensitive design detail, and place individuals whose details appear in project files at risk of targeted fraud or social engineering. Even when the full scope is unconfirmed, the appearance of an architecture firm on a ransomware leak site raises legitimate concern for anyone who has worked with or for the organisation.

The information in question

The reported summary states that internal files were exfiltrated and describes the stolen data as architecture and planning material totaling 45 GB. No more granular list of data types—such as employee records, client databases, financial files or authentication credentials—has been disclosed in the available facts. The number of people affected is unknown.

Organisations in architecture and planning typically hold project documentation, contracts, invoices, email archives and directories of staff, clients and partners. Those categories frequently contain names, business and sometimes personal contact information, and other identifiers. Because the exact contents of the 45 GB claimed by Booba Project have not been independently itemised in the public report, it is not possible to state with certainty which of those typical categories, if any, were included. The precise composition of the exposed material remains unconfirmed.

The real-world impact

For individuals whose details may appear in project or internal files, the practical risks include phishing and social-engineering attempts that reference real project names or colleagues, and, in some cases, identity-related fraud if personal data was present. Because the affected population size is unknown and the data types are only broadly described, people connected to the firm cannot yet know from public sources alone whether they are included.

For the organisation, consequences can include operational disruption if systems were encrypted or taken offline, reputational harm from the public listing, potential contractual or regulatory notification duties, and the cost of investigation and remediation. Clients and partners may also face secondary exposure if their project information or contact details formed part of the claimed archive. None of these outcomes is established as fact solely by a leak-site listing; they are the ordinary range of risks that follow when internal professional files are alleged to have been taken.

Were you affected?

If you are a current or former employee, client, consultant or partner of Pelli Clarke Pelli Architects, treat the listing as a reason for caution rather than proof that your data was included. Monitor accounts and inboxes for unexpected messages that reference the firm or specific projects. Prefer official channels when verifying any communication that asks for credentials, payment or personal information. Consider placing fraud alerts with major credit bureaus if you have reason to believe sensitive personal data may have been involved, and review financial and email accounts for unusual activity.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step does not confirm or rule out involvement in this specific incident, but it can help you see whether your address is circulating in other compromised collections and prompt you to strengthen passwords and enable multi-factor authentication where it is not already in use.

AICompiled with AI assistance from public sources and published under our editorial standards.