WOHA Listed by lamashtu Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations across sectors as part of a persistent threat landscape where data exfiltration followed by public listing has become a common pressure tactic. On 6 May 2026 the lamashtu ransomware group listed Singapore-based architectural practice WOHA on its leak site, stating that internal files had been taken during a ransomware attack. The number of individuals potentially affected remains unknown, and no further technical details about the intrusion have been made public.

Breaking down the breach

The incident came to light solely through the group’s leak-site posting on the reported date. The listing asserts that files were removed from WOHA systems, yet the scale of the operation, the precise method of access, and any ransom demand or payment status are not disclosed in available information. No independent confirmation of the data’s contents or volume has been released by the organisation or by investigators.

Who is lamashtu?

Lamashtu is a ransomware operation that follows the now-standard double-extortion model: data is encrypted on victim systems while copies are removed and later threatened with publication. Such groups typically maintain a public-facing site on the dark web where they name organisations they claim to have compromised, using the listings to increase pressure for payment. Their activity forms part of a broader pattern of financially motivated actors that select targets across multiple industries rather than focusing on a single sector.

About WOHA

WOHA is a Singapore-headquartered architectural firm established in 1994 by Wong Mun Summ and Richard Hassell. It is known for projects that combine environmental and social considerations in dense urban environments. Firms of this type routinely manage project documentation, client correspondence, technical drawings, and internal administrative records, all of which can contain sensitive commercial or personal information.

What data was at risk

The only detail provided is that internal files were allegedly exfiltrated. The exact categories of information contained in those files have not been specified. Architectural practices commonly store client contact details, contract information, employee records, and proprietary design materials, yet it is not confirmed whether any of these categories were present in the material referenced by the listing.

The real-world impact

Exposure of internal files can create risks of further misuse, including attempts at fraud or competitive intelligence gathering, depending on the nature of the documents. For the organisation, the listing itself may affect client trust and require additional resources for investigation and remediation. Individuals whose information appears in the files face the standard uncertainties associated with any unconfirmed data exposure until more details emerge.

If your data was in this claimed breach

Individuals concerned about possible exposure should begin by monitoring accounts for unusual activity and enabling multi-factor authentication where available. They can also request copies of any personal data held by relevant organisations under applicable data-protection rules. A free exposure scan of an email address against known breach data sets can provide an initial indication of whether information has appeared in public listings.

• Change passwords for any accounts linked to the organisation.
• Review bank and credit statements for unexpected transactions.
• Consider placing a credit freeze if personal identifiers were likely involved.
• Keep records of any correspondence from WOHA about the incident.

AICompiled with AI assistance from public sources and published under our editorial standards.