Kyowa Singapore Pte Ltd Data Breach

Morpheus ransomware has listed Kyowa Singapore Pte Ltd, a business services company based in Singapore, as a victim on July 21, 2026. This listing was identified by SOCRadar’s Dark Web Monitoring. While the business services sector is a common target for Morpheus, the company’s Singaporean location presents a geographic anomaly for the threat group, which typically focuses its operations within India. Over the preceding 60 days, Morpheus had claimed four other victims, indicating a lower volume of activity compared to other tracked operations. The group’s primary focus remains on the business services industry, with occasional targets in the financial services and technology sectors. Notably, almost all of Morpheus’s claimed victims are located in India, including Hansa Research Group, HDFC Fund, and 3i Infotech, as well as the firm Delegal Poindexter & Underkofler. Kyowa Singapore Pte Ltd’s listing thus stands out as a significant geographic outlier, despite aligning with the group’s preferred industry.

A correlation attempt against SOCRadar’s stealer-log telemetry data showed no records found for the domain kyowasingapore[.]com within the queried segment. It is important to note that this represents a bounded and paginated sample from a single data source. Therefore, potential credential exposure could exist under alternate corporate domains or via staff personal email aliases. A null result from this specific query does not definitively confirm the absence of any compromise. Infostealer logs commonly serve as an initial access vector for ransomware groups such as Morpheus. Threat actors or initial access brokers often acquire these logs to validate corporate credentials. These credentials are then used to gain access to systems like Microsoft 365, VPNs, or remote-access portals, subsequently enabling the deployment of ransomware. Consequently, the absence of immediate evidence of compromise does not eliminate the possibility of an intrusion. Continuous monitoring of kyowasingapore[.]com is recommended, alongside proactive credential hygiene checks.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.