UPR.SG Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 10, 2024, the organization UPR.SG appeared on a listing by the safepay ransomware group. The group claims to have conducted a ransomware attack that included the exfiltration of internal files. For anyone whose personal, financial, or professional details may sit inside those files—employees, clients, partners, or contractors—the practical stakes are straightforward: stolen data can be used for fraud, phishing, or identity misuse long after the initial incident.

The number of people affected is unknown, and public reporting supplies only limited specifics. What is clear is that a claim of data theft has been made public. That alone is enough reason for those connected to UPR.SG to understand the known facts, the typical methods of the group involved, and the concrete steps that reduce personal risk.

Breaking down the breach

According to the available record, UPR.SG was listed by the safepay ransomware group on December 10, 2024. The listing asserts that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access method, the duration of unauthorized access, the volume of data taken, or any ransom demand—have been disclosed in the public summary. The number of individuals whose information may be involved is also unknown.

The only organizational figure attached to the report is a revenue figure of $8.9 million. Beyond that single data point and the claim of internal-file exfiltration, the public record does not expand on the scope or timeline of the incident. All statements about what was taken therefore rest on the group’s own listing rather than on independent confirmation.

Who is safepay?

Safepay is a ransomware operation that follows the now-common double-extortion model: encrypting systems while also stealing data, then threatening to publish or sell the stolen material if a ransom is not paid. Like other groups of this type, safepay maintains a leak site where it posts victim names and, in some cases, sample files to pressure payment. The group’s public activity has been documented across multiple industries; its listings are claims that must be treated as unverified until corroborated by the victim organization or by independent forensic evidence.

In this instance, safepay’s listing of UPR.SG constitutes an assertion that internal files were taken. No additional statements by the group about this specific victim—such as file counts, screenshots, or deadlines—appear in the facts available for this report. Readers should therefore regard the claim as exactly that: a claim made by the threat actor.

Who is UPR.SG?

UPR.SG is an organization whose reported revenue stands at $8.9 million. The .SG domain indicates a Singapore-based entity. Organizations of this scale and geographic footprint typically maintain internal systems that hold employee records, client or supplier information, financial documents, contracts, and operational files. A ransomware incident that includes data exfiltration therefore has the potential to touch both the company’s own staff and any external parties whose details are stored in those systems.

Because the precise business activities of UPR.SG are not elaborated in the public breach summary, it is not possible to map the incident onto a narrower sector. What remains relevant is the general consequence: any organization that processes personal or commercial data becomes a point of risk for the people whose information it holds when that data is claimed to have left its control.

What data was at risk

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data types—names, identity numbers, financial account details, medical records, or otherwise—has been published. Exact contents therefore remain unconfirmed.

Organizations of comparable size commonly store employee personal data, payroll information, customer or partner contact details, contracts, and internal correspondence. Any of those categories could, in principle, have been among the files taken. Until UPR.SG or independent investigators release a verified list, however, it is not possible to state with certainty which fields or records were exposed. The prudent assumption for anyone linked to the organization is that some personal or business information may now be outside the company’s control.

The real-world impact

For individuals, the primary risks are secondary fraud and social-engineering attacks. Stolen internal files can supply enough context for convincing phishing messages, account-takeover attempts, or identity-related scams. Even if the data never appears on public markets, the mere fact that it has been copied by criminals creates a lasting exposure window.

For the organization itself, the consequences include operational disruption from the ransomware encryption, potential regulatory scrutiny under Singapore’s data-protection rules, reputational damage, and the cost of investigation and remediation. Because the number of affected people is unknown, the full scale of notification and support obligations also remains unclear. None of these outcomes require sensational language; they are the ordinary, documented results of ransomware incidents that combine encryption with data theft.

What to do if you're exposed

If you have a past or present relationship with UPR.SG—as an employee, client, supplier, or contractor—treat the listing as a signal to act. Change passwords on any accounts that may have been shared with or used at the organization, enable multi-factor authentication wherever it is available, and monitor bank and credit statements for unfamiliar activity. Be alert to unexpected emails or calls that reference internal details; such messages may be crafted from stolen files.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. Doing so provides an immediate, concrete indicator of whether your information has surfaced elsewhere and helps prioritize further protective steps. Remain calm, document any suspicious contacts, and rely on official channels from UPR.SG or relevant authorities for confirmed guidance as more details, if any, become public.

AICompiled with AI assistance from public sources and published under our editorial standards.