dragonforce
First seen December 13, 2023Active668 claimed victims
The claims below are reproduced as posted by dragonforce on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| oakgrovetech | October 18, 2026 | ransomlook | — |
| Lane Equipment | October 14, 2026 | ransomware_live | — |
| Canadian Mennonite University (CMU) | October 12, 2026 | ransomlook | — |
| TQC S.A. | October 11, 2026 | ransomlook | — |
| TEXMA International Co., Ltd | October 10, 2026 | ransomlook | — |
| RÉSO | October 7, 2026 | ransomware_live | — |
| Petrosul Distribuidora, Transportadora e Comércio de Combustíveis Ltda. | October 7, 2026 | ransomware_live | — |
| oakgrovetech | October 2, 2026 | ransomware_live | — |
| winfashion | September 24, 2026 | ransomlook | — |
| HEC Group | September 24, 2026 | ransomlook | — |
| Elite Industech Co., Ltd | September 24, 2026 | ransomlook | — |
| BMGP Groupe | September 24, 2026 | ransomlook | — |
| Arizona Vascular Medical Equipment, Inc | September 24, 2026 | ransomlook | — |
| arsrenacer.com | September 21, 2026 | ransomlook | — |
| Owen Leigh Optometry | September 16, 2026 | ransomlook | — |
| Community Property Management | September 16, 2026 | ransomlook | — |
| Medical Department Store | September 11, 2026 | ransomlook | — |
| Norwood Law Firm | September 4, 2026 | ransomlook | — |
| Homewood Sales | September 4, 2026 | ransomlook | — |
| arsrenacer.com | September 1, 2026 | ransomware_live | — |
| rubbermill.com | September 1, 2026 | ransomlook | — |
| winfashion | August 24, 2026 | ransomware_live | — |
| Wozair | August 24, 2026 | ransomware_live | — |
| Brookview Financial | August 24, 2026 | ransomware_live | — |
| Criba | August 24, 2026 | ransomware_live | — |
| Frato | August 24, 2026 | ransomware_live | — |
| Hogan Omidi P.C. | August 21, 2026 | ransomware_live | — |
| R & D Machine and Engineering | August 18, 2026 | ransomware_live | — |
| Vermont XCenter | August 17, 2026 | ransomware_live | — |
| rubbermill.com | August 15, 2026 | ransomware_live | — |
| GB Group S.A | August 11, 2026 | ransomware_live | — |
| QPC Global | August 10, 2026 | ransomware_live | — |
| Mike Graham Heating And Air Conditioning | August 5, 2026 | ransomware_live | — |
| P. A. Inc. (Performance Alloys) | August 5, 2026 | ransomware_live | — |
| Primary Eye Care | August 5, 2026 | ransomware_live | — |
| EduSpa | August 5, 2026 | ransomware_live | — |
| TUI China | August 3, 2026 | ransomware_live | — |
| Lamont Pridmore | July 31, 2026 | ransomware_live | — |
| www.mbmlawsc.com | July 30, 2026 | ransomware_live | — |
| RUS Industrial | July 30, 2026 | ransomware_live | — |
| Katathani Phuket Beach Resort | July 27, 2026 | ransomware_live | — |
| Deluxe Medical Supply | July 26, 2026 | ransomware_live | — |
| Syntron Bioresearch | July 26, 2026 | ransomware_live | — |
| ID engineering | July 24, 2026 | ransomware_live | — |
| Koshkaryan Law Group | July 22, 2026 | ransomware_live | — |
| One Community FCU | July 21, 2026 | ransomware_live | — |
| Baicizhan | July 21, 2026 | ransomware_live | — |
| NewNet | July 18, 2026 | ransomware_live | — |
| Kee Wah Bakery | July 16, 2026 | ransomware_live | — |
| Sinai Grand Casino | July 16, 2026 | ransomware_live | — |
| Petrini Valores | July 16, 2026 | ransomware_live | — |
| Stephens Precision | July 15, 2026 | ransomware_live | — |
| Shillen Mackall & Seldon | July 15, 2026 | ransomware_live | — |
| Hughes Atwood & Mullaly pllc | July 15, 2026 | ransomware_live | — |
| Heritage Mechanical LLC | July 15, 2026 | ransomware_live | — |
| North Atlantic Engineering Consultants | July 15, 2026 | ransomware_live | — |
| Metro Design Cente | July 15, 2026 | ransomware_live | — |
| Southport Outdoor Living | July 15, 2026 | ransomware_live | — |
| momenta.cn | July 14, 2026 | ransomware_live | — |
| asimar.com | July 14, 2026 | ransomware_live | — |
| Ifage | July 14, 2026 | ransomware_live | — |
| Omax Autos | July 14, 2026 | ransomware_live | — |
| Midal Cables | July 14, 2026 | ransomware_live | — |
| Atcom | July 14, 2026 | ransomware_live | — |
| Intron Technology Holdings | July 14, 2026 | ransomware_live | — |
| Road Ahead Technologies Consultant | July 14, 2026 | ransomware_live | — |
| Graphic International Centre | July 14, 2026 | ransomware_live | — |
| SITAV SpA | July 14, 2026 | ransomware_live | — |
| Edison Global Networks Limited | July 14, 2026 | ransomware_live | — |
| Isegen South Africa (Pty) Ltd | July 14, 2026 | ransomware_live | — |
| www.twtci.com Trans World Trading | July 13, 2026 | ransomware_live | — |
| degeremcia.com | July 13, 2026 | ransomware_live | — |
| Nicholson y Cano Abogados | July 13, 2026 | ransomware_live | — |
| Northeast Rescue Systems | July 13, 2026 | ransomware_live | — |
| STEP Oiltools | July 12, 2026 | ransomware_live | — |
| Al - Saidi Factory | July 12, 2026 | ransomware_live | — |
| The Schuett Companies | July 10, 2026 | ransomware_live | — |
| Access Equipment Hire | July 10, 2026 | ransomware_live | — |
| amplesurveyor.com | July 6, 2026 | ransomware_live | — |
| hive360.com | July 6, 2026 | ransomware_live | — |
| medipakpharma.com | June 28, 2026 | ransomware_live | — |
| vipimaging | June 28, 2026 | ransomware_live | — |
| stni.co.kr | June 28, 2026 | ransomware_live | — |
| agroprime | June 28, 2026 | ransomware_live | — |
| hwaseng | June 28, 2026 | ransomware_live | — |
| Aptora | June 27, 2026 | ransomware_live | — |
| mihana-v.com | June 20, 2026 | ransomware_live | — |
| bits-pilani.ac.in | June 20, 2026 | ransomware_live | — |
| Tecfi SpA | June 15, 2026 | ransomware_live | — |
| Ink | June 14, 2026 | ransomware_live | — |
| The DRM | June 12, 2026 | ransomware_live | — |
| Al Shafar GRC | June 12, 2026 | ransomware_live | — |
| A. Liberty Engineering Co. Ltd | June 12, 2026 | ransomware_live | — |
| Corniche Hotel Abu Dhabi | June 12, 2026 | ransomware_live | — |
| Al Ishrak Contracting | June 12, 2026 | ransomware_live | — |
| Cheoy Lee Shipyards | June 12, 2026 | ransomware_live | — |
| Brian Cox | June 11, 2026 | ransomware_live | — |
| Cekok | June 11, 2026 | ransomware_live | — |
| Astec Valves & Fittings Pvt | June 11, 2026 | ransomware_live | — |
| Hong Kong Parkview | June 11, 2026 | ransomware_live | — |
Page 1 of 7Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).