Raffles United Holdings Pte Ltd Data Breach

Raffles United Holdings Pte Ltd, a Singapore-based hospitality company and the parent of Kian Ho Group, which conducts industrial supply and distribution across ASEAN, was listed as a victim on the leak site of the Orova ransomware group on November 3, 2026. The listing was identified through SOCRadar Dark Web Monitoring. As a conglomerate spanning hospitality operations and industrial distribution across the ASEAN region, the organization maintains a diverse operational footprint and supply-chain role that can make it an attractive target for ransomware and extortion activity, particularly given the operational disruption potential across its affiliated businesses. The Orova ransomware group has claimed 17 other victims in the past 60 days, with a focus on Singapore, Malaysia, and India, and has most frequently targeted the Technology, Other services, and Hospitality sectors. Within the current window, Orova has co-listed several Singapore-based organizations, including Harry’s International, Orient Corporation, and Detronics Pte Ltd. Raffles United is the fourth victim in this Singapore cluster. As a hospitality company operating in Singapore, Raffles United aligns directly with Orova’s most frequently targeted sector and falls squarely within the group’s leading victim country, making the listing consistent with the group’s recent targeting pattern.

SOCRadar’s stealer-log telemetry was queried for the corporate domain kianho[.]com.sg and returned 10 records in total. Nine of these are category C records, indicating corporate users accessing third-party services, plus one additional record. All records are tied to two masked kianho[.]com.sg corporate email identities. The exposure window spans February to September 2026, covering a period of eight months. The dominant profile observed in this dataset is Workstation Compromise Risk, indicating credentials harvested from compromised endpoints in corporate use. The standout endpoint in the dataset is a mobile HR/timekeeping application on Android. This indicates that at least one endpoint, likely a mobile device, is running a compromised stealer, pulling credentials from every app and service the user touches. This finding represents only the records present in the queried dataset; it does not confirm that the organization is unaffected beyond these results, as credentials may exist under alternate corporate domains, personal email aliases, or feeds outside the queried dataset, and data not yet indexed or credentials already rotated would not appear. This pattern of eight months of credential exfiltration across multiple third-party services from two identities fits the pre-deployment reconnaissance phase for ransomware operations. Harvested credentials of this kind can support initial access through corporate accounts, remote-access portals, or similar pathways, though the exact access method used, if any, is not confirmed by this telemetry. Recommended actions: treat both masked identities as compromised and proceed immediately with credential rotation, endpoint investigation, and HR/timekeeping system access audits, alongside continued dark web and stealer-log monitoring.