sbws.org.sg Listed by safepay Ransomware Group

On November 28, 2025, the Singapore Buddhist Welfare Services (SBWS) appeared on the leak site of the safepay ransomware group. The organisation, a long-standing voluntary welfare group that provides community support across Singapore, had internal files exfiltrated during a ransomware attack. Anyone whose personal information was held by SBWS — including donors, beneficiaries, volunteers and their families — may now face heightened risk of identity theft and doxxing.

What's Publicly Reported from Reporting

Public reporting indicates that safepay listed SBWS on its dark-web leak site on 28 November 2025. The posting states that internal files were stolen during a ransomware incident. No exact victim count has been released, and the precise volume or content of the exfiltrated data remains unclear from available reporting. The organisation itself has not yet issued a public statement detailing the breach scope or notifying affected individuals.

Why This Matters for You and Your Family

When a community organisation like SBWS suffers a breach, ordinary people are often the ones exposed. Your donation records, contact details, family member information or beneficiary files could be sitting in the hands of criminals. Internal files frequently contain names, addresses, phone numbers, email accounts, dates of birth and financial details. Once that information reaches a leak site, it rarely stays private. Criminals scan these dumps within hours and begin building profiles that can lead to account takeovers, phishing campaigns or demands for payment.

The Doxxing and Identity-Chain Implications

A single breach rarely stops at one organisation. Credential leaks like this one often cascade into account takeovers on email, banking or social media. Attackers then follow the identity chain — linking your phone number to your children’s gaming accounts, your home address to family members, and your email to every service where you reused the same password. What begins as a welfare-service breach can quickly become a full doxxing chain that exposes your entire household. Public reporting describes this pattern repeating across recent ransomware incidents, where initial access leads to broad exfiltration and eventual public shaming or extortion.

Safepay Group’s Known Track Record

Public reporting attributes safepay with emerging in late 2024. The group has targeted hospitals, schools, non-profits and small government-linked entities. Its typical playbook involves gaining initial access through phishing or unpatched remote desktop services, exfiltrating sensitive files before encryption, then publishing samples on its leak site if the victim refuses to pay. Extortion demands usually combine threats of data release with offers of “secure deletion” for a fee. The group maintains an active presence on dark-web forums and updates its site frequently with new victims.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers and real identity, then use the cleanup of Warden to remove what you can.
• Rotate the password you used anywhere it was reused at SBWS and enable 2FA through an authenticator app on every account that accepts it.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Cover the household — DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The incident shows that even respected community organisations can be hit without warning, leaving ordinary families to manage the consequences. Taking concrete steps now limits how far attackers can travel along your identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes your children’s gaming accounts. Start your DoxxScan trial today and close the gaps before the next breach appears on another leak site.