sce.org.sg Listed by lynx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure public-sector and government-linked organisations worldwide by combining encryption with data theft and public leak-site listings. In this climate, even a single listing can raise legitimate questions for partners, staff and citizens who interact with the named entity.

On 28 January 2025 the domain sce.org.sg appeared on a leak site operated by the ransomware group known as lynx. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown and further technical detail has not been released. The listing itself is a claim by the group and has not been independently confirmed in the available record.

Inside the incident

According to the reported summary, the Singapore Cooperation Enterprise (SCE), operating under the domain sce.org.sg, was listed by the lynx ransomware group on 28 January 2025. The only concrete description of the compromise is that internal files were allegedly exfiltrated during a ransomware attack. No public figure has been given for the volume of data taken, the number of systems affected, the initial access method, or the precise timeline of the intrusion. Whether encryption was successfully deployed, whether a ransom demand was issued, or whether any negotiation took place are all undisclosed. The listing therefore stands as an unverified claim by the threat actor rather than a fully corroborated incident report.

Inside lynx

Lynx is a ransomware operation that became publicly visible in mid-2024. Like many contemporary groups it follows a double-extortion model: data is stolen before systems are encrypted, and victims are threatened with publication on a dedicated leak site if payment is not made. The group has listed organisations across multiple sectors and geographies, typically releasing sample files or full archives after a countdown period. Public analyses describe lynx as using standard ransomware tooling, affiliate-style recruitment and Tor-hosted negotiation portals. None of these general characteristics, however, constitute proof of the specific actions claimed against sce.org.sg; they merely place the listing in the context of the group’s established pattern of behaviour.

Who is sce.org.sg?

The Singapore Cooperation Enterprise was established in 2006 by Singapore’s Ministry of Trade and Industry and Ministry of Foreign Affairs. Its mandate is to respond to foreign governments seeking to learn from Singapore’s development experience. SCE works with the country’s 16 ministries and more than 60 statutory boards to design and deliver tailored advisory and capacity-building programmes. It functions as a single point of access to Singapore public-sector expertise and is described as an integrated arm of the government machinery that supports international cooperation. Because of this role, SCE routinely handles correspondence, project documentation and contact details involving foreign officials, Singapore civil servants and technical specialists. A breach at such an organisation therefore carries implications that extend beyond a single agency to the wider network of bilateral and multilateral relationships it supports.

What was likely exposed

The only data type named in the public record is “internal files” exfiltrated in the ransomware attack. Exact contents, file counts and sensitivity levels have not been disclosed. Organisations of SCE’s type typically hold project proposals, meeting notes, contact lists of government counterparts, contractual documents and internal administrative records. Whether any of those categories were among the files taken remains unconfirmed.

• Internal files (exfiltrated, per the group’s claim)
• Exact data categories, volumes and sensitivity levels: undisclosed
• Number of individuals whose information may be involved: unknown

What's at stake

For individuals whose details appear in the stolen material, the principal risks are phishing, social-engineering attempts that reference genuine projects, and possible misuse of contact or organisational information. Because SCE works with foreign governments, compromised documents could also be used to map relationships or to craft more convincing impersonation messages. For the organisation itself, the stakes include reputational damage among international partners, potential disruption of ongoing programmes, and the operational cost of investigation, remediation and any required notifications. No confirmed evidence of secondary misuse has been published, yet the mere existence of an unauthorised copy of internal files creates a lasting exposure window.

What to do if you're exposed

Anyone who has worked with or corresponded with SCE should treat unsolicited emails or messages that reference past projects with heightened caution. Change passwords on any accounts that may have been used in official correspondence, enable multi-factor authentication where available, and monitor financial and email accounts for unusual activity. If you receive a notification from SCE or a Singapore government agency, follow the instructions it provides. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan is a practical first step while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.