RDC Architects Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have worked with RDC Architects, or whose personal or project details may sit in the firm’s systems, now face a practical question: whether internal files taken in a claimed ransomware incident could surface online. Public reporting on 27 January 2025 states that the qilin ransomware group listed the company and asserted that all of its data would be made available for download on 2 February 2025. The number of individuals affected remains unknown, and the precise contents of the material have not been independently confirmed.

For clients, partners, staff and anyone whose contact or project information may have been stored by an architecture practice of this size, the listing raises ordinary but serious concerns about privacy, fraud risk and the possible misuse of business records. What follows is a factual account limited to what has been reported and to well-established public knowledge of the threat actor and the sector.

What happened

On 27 January 2025, RDC Architects was reported as listed by the qilin ransomware group. According to the group’s claim, internal files were exfiltrated in a ransomware attack and “all data of this company will be available for download on 02.02.2025.” The listing identifies the organisation as RDC Architects Pte Ltd, operating in architecture, engineering and design, with 10 to 19 employees and revenue in the 1 million to 5 million range. The number of people affected is unknown. No independent confirmation of the intrusion, the volume of data, or the exact method of access has been published in the available facts. The leak-site entry itself remains an unverified claim by the group.

Inside qilin

qilin is a ransomware operation that has been publicly documented for several years. Like many contemporary groups, it typically follows a double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if a ransom is not paid. The group has been observed recruiting affiliates, using common initial-access techniques such as compromised credentials or vulnerable remote services, and posting victim names and sample files to pressure organisations. Public reporting has linked qilin to attacks across multiple sectors and regions; its listings are claims made by the operators and are not, by themselves, proof that every asserted detail is accurate. In this case, the only statements attributed to the group about RDC Architects are those contained in the reported listing—namely that internal files were taken and that a full data release was scheduled for 2 February 2025.

Who is RDC Architects?

RDC Architects Pte Ltd is described in the reporting as a company in the architecture, engineering and design industry. Firms of this type typically prepare building plans, manage client projects, coordinate with contractors and regulators, and hold records that can include drawings, contracts, correspondence, employee details and, in some cases, personal data of clients or site contacts. With a reported headcount of 10 to 19 people and revenue between 1 million and 5 million, it is a small-to-mid-sized practice. A breach affecting such an organisation can be consequential because architectural work often involves long-running projects, sensitive commercial information and personal identifiers that, if exposed, can be reused for fraud, competitive intelligence or further social-engineering attacks against clients and staff.

What was likely exposed

The facts state only that “internal files” were exfiltrated in a ransomware attack; no further breakdown of data types, file counts or categories has been disclosed. Organisations in architecture and engineering commonly hold project documentation, client contact lists, contracts, financial records, employee information and design files. Whether any of those categories were among the material claimed by qilin is unconfirmed. Readers should treat the group’s assertion that “all data” would be released as a claim rather than established fact until independent verification appears.

Why it matters

For individuals whose details may have been stored by the firm, the practical risks include phishing that references real projects, identity fraud if personal identifiers were present, and unwanted contact from third parties who obtain the material. For the organisation itself, publication of internal files can disrupt ongoing work, damage client trust and create regulatory or contractual obligations depending on the jurisdictions involved. Because the scale of the incident and the exact contents remain unknown, the degree of harm cannot yet be measured; the listing alone is sufficient reason for cautious monitoring by anyone who has a relationship with the practice.

If your data was in this claimed breach

If you believe your information may have been held by RDC Architects, a few measured steps can reduce residual risk:

• Watch for unexpected emails or calls that reference architectural projects, invoices or staff names associated with the firm; treat unsolicited requests for credentials or payments with caution.
• Change passwords on any accounts that reused credentials possibly stored in business systems, and enable multi-factor authentication where available.
• Review financial and credit activity for unusual applications or charges if personal identifiers were ever shared with the practice.
• Retain any official notifications you receive from the company or from regulators, and follow their guidance if further details emerge.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Public detail on this incident remains limited; any new confirmed information should be evaluated against official statements rather than solely against the ransomware group’s claims.

AICompiled with AI assistance from public sources and published under our editorial standards.