Codar (Pte) Ltd Data Breach

Orova has claimed a data breach involving Codar (Pte) Ltd, a technology firm based in Singapore. The listing was observed on October 13, 2026, and marks Orova’s third claimed victim in the current reporting cycle, alongside Alfameli Group and Durga Bearings. Technology and IT services companies, particularly those in Southeast Asia, are frequent targets for ransomware groups like Orova, leveraging Singapore’s status as a regional hub. The sector’s reliance on complex infrastructure and interconnected services presents a broad attack surface. In 2026, Orova has actively targeted technology and IT services firms across Southeast Asia, the Middle East, and Europe. Singaporean technology companies are particularly susceptible due to their role as regional hubs. The group has also shown a pattern of targeting manufacturing and industrial organizations during the same period. This victim profile aligns with Orova’s broader targeting trends, which often focus on entities within critical infrastructure and service provision sectors.

SOCRadar’s investigation queried the domain codar[.]com.sg within criminal market sources prior to the claim. No associated records were found, and no infostealer-linked initial access signals were detected for this specific domain. The coverage of stealer-log data for Singapore-based technology organizations can vary significantly across different criminal market intelligence feeds. However, the absence of direct telemetry does not confirm that the organization is unaffected. Plausible initial access vectors for such incidents include phishing attacks, exploitation of vulnerabilities in software development or cloud infrastructure, and credential compromise through unmonitored channels. These methods can bypass direct detection on specific domains. The claim by Orova carries typical ransomware risks, including the potential loss of proprietary code or client data, service disruptions, and the possibility that client environments accessible through Codar’s infrastructure may have been compromised. The lack of specific stealer-log data associated with this listing means the urgency of the threat does not exceed the baseline for such claims. Codar’s clients should exercise caution regarding any code, software, or systems provided by Codar and implement additional verification for updates or access originating from Codar’s infrastructure. The Cybersecurity Agency of Singapore (CSA) has provided ransomware preparedness guidance specifically for technology organizations in the region.