Harry's International

This record is a provider-reported ransomware claim attributed to Orova. It is an allegation and has not been independently confirmed.

Claim context

Provider-reported sector: Retail & E-Commerce
Provider-reported country: Singapore
Group-published claim date: 2026-11-02T00:00:00.000Z
First tracked: 2026-11-02T11:06:29.679Z
Last observed: 2026-11-02T16:54:24.558Z
Monitoring providers: 4
Independent monitoring providers: 4
Website: harrys.com.sg
Post URL: https://cti.fyi/
Data source: unified
Duplicate records merged: 3

Provider observation timeline

Newest observations first. Provider observations are not independent confirmation of an incident.

Monitoring provider: observed 2026-11-02T16:54:24.558Z; source-published 2026-11-02T00:00:00.000Z; retrieved 2026-11-03T10:05:19.544Z.
Monitoring provider: observed 2026-11-02T11:27:45.807Z; source-published 2026-11-02T00:00:00.000Z; retrieved 2026-11-02T11:51:51.655Z.
Monitoring provider: observed 2026-11-02T11:23:16.987Z; source-published 2026-11-02T11:23:16.987Z; retrieved 2026-11-02T11:51:51.655Z.
Monitoring provider: observed 2026-11-02T11:06:29.679Z; source-published 2026-11-02T10:48:14.000Z; retrieved 2026-11-03T00:09:40.144Z.

Provider records

Every stored provider record behind this claim, newest first.

Provider credit
ransomware.live
Provider URL
https://www.ransomware.live/
Feed id
privtools-ransomposts
Provider record id
derived-sha256:c09ba2f95852bd162c0963ba7da25c8624dac99448f61bccb09d4c7223516cb1
Observed
2026-11-02T16:54:24.558Z
Source-published
2026-11-02T00:00:00.000Z
Retrieved
2026-11-03T10:05:19.544Z
Format
json-array
Transport
https-json
Overlap class
primary
Independent corroboration
yes
Provider credit
cybercrime.works
Provider URL
https://cybercrime.works/leaks/67a97207-3215-4009-9c8b-7b38aaa37546
Feed id
cybercrime-works
Provider record id
67a97207-3215-4009-9c8b-7b38aaa37546
Observed
2026-11-02T11:27:45.807Z
Source-published
2026-11-02T00:00:00.000Z
Retrieved
2026-11-02T11:51:51.655Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
RansomLook
Provider URL
https://www.ransomlook.io/
Feed id
ransomlook
Provider record id
derived-sha256:a0a0b20e08a43d5def95cdb0f1b9738e1ac8e15ca660781da60aaed5aea86913
MISP event UUID
3458399e-7a0e-5487-917f-7e98134f25c8
Observed
2026-11-02T11:23:16.987Z
Source-published
2026-11-02T11:23:16.987Z
Retrieved
2026-11-02T11:51:51.655Z
Format
json-array
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
CTI.FYI
Provider URL
https://cti.fyi/
Feed id
cti-fyi
Provider record id
derived-sha256:865f03635ba281718f39c712fc8a9adf9b68d9bf4fd7f4ea37dc7cf861d4e59e
Observed
2026-11-02T11:06:29.679Z
Source-published
2026-11-02T10:48:14.000Z
Retrieved
2026-11-03T00:09:40.144Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes

Tracker record history

Newest entries first. These dates describe tracker records, not attack dates.

Provider update: recorded 2026-11-03T00:11:49.992Z; associated provider observation 2026-11-02T11:06:29.679Z.
Provider update: recorded 2026-11-02T17:08:53.924Z; associated provider observation 2026-11-02T11:23:16.987Z.
Initial tracker record: recorded 2026-11-02T11:53:17.888Z; associated provider observation 2026-11-02T11:23:16.987Z.