dragonforce
First seen December 13, 2023Active648 claimed victims
The claims below are reproduced as posted by dragonforce on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Norwood Law Firm | September 4, 2026 | ransomlook | — |
| Homewood Sales | September 4, 2026 | ransomlook | — |
| rubbermill.com | September 1, 2026 | ransomlook | — |
| Wozair | August 24, 2026 | ransomware_live | — |
| Brookview Financial | August 24, 2026 | ransomware_live | — |
| Criba | August 24, 2026 | ransomware_live | — |
| Frato | August 24, 2026 | ransomware_live | — |
| Hogan Omidi P.C. | August 21, 2026 | ransomware_live | — |
| R & D Machine and Engineering | August 18, 2026 | ransomware_live | — |
| Vermont XCenter | August 17, 2026 | ransomware_live | — |
| GB Group S.A | August 11, 2026 | ransomware_live | — |
| QPC Global | August 10, 2026 | ransomware_live | — |
| Mike Graham Heating And Air Conditioning | August 5, 2026 | ransomware_live | — |
| P. A. Inc. (Performance Alloys) | August 5, 2026 | ransomware_live | — |
| Primary Eye Care | August 5, 2026 | ransomware_live | — |
| EduSpa | August 5, 2026 | ransomware_live | — |
| TUI China | August 3, 2026 | ransomware_live | — |
| Lamont Pridmore | July 31, 2026 | ransomware_live | — |
| www.mbmlawsc.com | July 30, 2026 | ransomware_live | — |
| RUS Industrial | July 30, 2026 | ransomware_live | — |
| Katathani Phuket Beach Resort | July 27, 2026 | ransomware_live | — |
| Deluxe Medical Supply | July 26, 2026 | ransomware_live | — |
| Syntron Bioresearch | July 26, 2026 | ransomware_live | — |
| ID engineering | July 24, 2026 | ransomware_live | — |
| Koshkaryan Law Group | July 22, 2026 | ransomware_live | — |
| One Community FCU | July 21, 2026 | ransomware_live | — |
| Baicizhan | July 21, 2026 | ransomware_live | — |
| NewNet | July 18, 2026 | ransomware_live | — |
| Kee Wah Bakery | July 16, 2026 | ransomware_live | — |
| Sinai Grand Casino | July 16, 2026 | ransomware_live | — |
| Petrini Valores | July 16, 2026 | ransomware_live | — |
| Stephens Precision | July 15, 2026 | ransomware_live | — |
| Shillen Mackall & Seldon | July 15, 2026 | ransomware_live | — |
| Hughes Atwood & Mullaly pllc | July 15, 2026 | ransomware_live | — |
| Heritage Mechanical LLC | July 15, 2026 | ransomware_live | — |
| North Atlantic Engineering Consultants | July 15, 2026 | ransomware_live | — |
| Metro Design Cente | July 15, 2026 | ransomware_live | — |
| Southport Outdoor Living | July 15, 2026 | ransomware_live | — |
| momenta.cn | July 14, 2026 | ransomware_live | — |
| asimar.com | July 14, 2026 | ransomware_live | — |
| Ifage | July 14, 2026 | ransomware_live | — |
| Omax Autos | July 14, 2026 | ransomware_live | — |
| Midal Cables | July 14, 2026 | ransomware_live | — |
| Atcom | July 14, 2026 | ransomware_live | — |
| Intron Technology Holdings | July 14, 2026 | ransomware_live | — |
| Road Ahead Technologies Consultant | July 14, 2026 | ransomware_live | — |
| Graphic International Centre | July 14, 2026 | ransomware_live | — |
| SITAV SpA | July 14, 2026 | ransomware_live | — |
| Edison Global Networks Limited | July 14, 2026 | ransomware_live | — |
| Isegen South Africa (Pty) Ltd | July 14, 2026 | ransomware_live | — |
| www.twtci.com Trans World Trading | July 13, 2026 | ransomware_live | — |
| degeremcia.com | July 13, 2026 | ransomware_live | — |
| Nicholson y Cano Abogados | July 13, 2026 | ransomware_live | — |
| Northeast Rescue Systems | July 13, 2026 | ransomware_live | — |
| STEP Oiltools | July 12, 2026 | ransomware_live | — |
| Al - Saidi Factory | July 12, 2026 | ransomware_live | — |
| The Schuett Companies | July 10, 2026 | ransomware_live | — |
| Access Equipment Hire | July 10, 2026 | ransomware_live | — |
| amplesurveyor.com | July 6, 2026 | ransomware_live | — |
| hive360.com | July 6, 2026 | ransomware_live | — |
| medipakpharma.com | June 28, 2026 | ransomware_live | — |
| vipimaging | June 28, 2026 | ransomware_live | — |
| stni.co.kr | June 28, 2026 | ransomware_live | — |
| agroprime | June 28, 2026 | ransomware_live | — |
| hwaseng | June 28, 2026 | ransomware_live | — |
| Aptora | June 27, 2026 | ransomware_live | — |
| mihana-v.com | June 20, 2026 | ransomware_live | — |
| bits-pilani.ac.in | June 20, 2026 | ransomware_live | — |
| Tecfi SpA | June 15, 2026 | ransomware_live | — |
| Ink | June 14, 2026 | ransomware_live | — |
| The DRM | June 12, 2026 | ransomware_live | — |
| Al Shafar GRC | June 12, 2026 | ransomware_live | — |
| A. Liberty Engineering Co. Ltd | June 12, 2026 | ransomware_live | — |
| Corniche Hotel Abu Dhabi | June 12, 2026 | ransomware_live | — |
| Al Ishrak Contracting | June 12, 2026 | ransomware_live | — |
| Cheoy Lee Shipyards | June 12, 2026 | ransomware_live | — |
| Brian Cox | June 11, 2026 | ransomware_live | — |
| Cekok | June 11, 2026 | ransomware_live | — |
| Astec Valves & Fittings Pvt | June 11, 2026 | ransomware_live | — |
| Hong Kong Parkview | June 11, 2026 | ransomware_live | — |
| Areco | June 11, 2026 | ransomware_live | — |
| Sayre Associates | June 10, 2026 | ransomware_live | — |
| REHA-ACTIV | June 5, 2026 | ransomware_live | — |
| SETS Solutions | June 3, 2026 | ransomware_live | — |
| Copamex | June 3, 2026 | ransomware_live | — |
| Panorama BPO | May 30, 2026 | ransomware_live | — |
| Taos Mountain Casino | May 30, 2026 | ransomware_live | — |
| Synex International Pvt Ltd | May 30, 2026 | ransomware_live | — |
| Henry Molded Products Likely to Engage tag. | May 29, 2026 | ransomware_live | — |
| Shoreline Sightseeing | May 29, 2026 | ransomware_live | — |
| WG Neukölln | May 27, 2026 | ransomware_live | — |
| Delbrook Capital Advisors | May 27, 2026 | ransomware_live | — |
| Greenway Technologies | May 27, 2026 | ransomware_live | — |
| dentonfirm.com | May 27, 2026 | ransomware_live | — |
| qlslogistics.com.au | May 27, 2026 | ransomware_live | — |
| duboisag.com | May 27, 2026 | ransomware_live | — |
| hbroch.com | May 27, 2026 | ransomware_live | — |
| Ramos Rheumatology | May 27, 2026 | ransomware_live | — |
| FWMK Law Offices | May 27, 2026 | ransomware_live | — |
| profundo.nl | May 27, 2026 | ransomware_live | — |
Page 1 of 7Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).