dragonforce
First seen December 13, 2023Active668 claimed victims
The claims below are reproduced as posted by dragonforce on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Areco | June 11, 2026 | ransomware_live | — |
| Sayre Associates | June 10, 2026 | ransomware_live | — |
| REHA-ACTIV | June 5, 2026 | ransomware_live | — |
| SETS Solutions | June 3, 2026 | ransomware_live | — |
| Copamex | June 3, 2026 | ransomware_live | — |
| Panorama BPO | May 30, 2026 | ransomware_live | — |
| Taos Mountain Casino | May 30, 2026 | ransomware_live | — |
| Synex International Pvt Ltd | May 30, 2026 | ransomware_live | — |
| Henry Molded Products Likely to Engage tag. | May 29, 2026 | ransomware_live | — |
| Shoreline Sightseeing | May 29, 2026 | ransomware_live | — |
| WG Neukölln | May 27, 2026 | ransomware_live | — |
| Delbrook Capital Advisors | May 27, 2026 | ransomware_live | — |
| Greenway Technologies | May 27, 2026 | ransomware_live | — |
| dentonfirm.com | May 27, 2026 | ransomware_live | — |
| qlslogistics.com.au | May 27, 2026 | ransomware_live | — |
| duboisag.com | May 27, 2026 | ransomware_live | — |
| hbroch.com | May 27, 2026 | ransomware_live | — |
| Ramos Rheumatology | May 27, 2026 | ransomware_live | — |
| FWMK Law Offices | May 27, 2026 | ransomware_live | — |
| profundo.nl | May 27, 2026 | ransomware_live | — |
| waypointsolutions.com | May 27, 2026 | ransomware_live | — |
| erh.co.uk | May 27, 2026 | ransomware_live | — |
| fabbricausa.com | May 27, 2026 | ransomware_live | — |
| nemd.com | May 27, 2026 | ransomware_live | — |
| pieralisi.com | May 27, 2026 | ransomware_live | — |
| jcripberger.com | May 27, 2026 | ransomware_live | — |
| wsm.co.uk | May 27, 2026 | ransomware_live | — |
| northbridge.com | May 27, 2026 | ransomware_live | — |
| dunasgroen.nl | May 27, 2026 | ransomware_live | — |
| refreshmentsystems.co.uk | May 27, 2026 | ransomware_live | — |
| practicus.co.uk | May 27, 2026 | ransomware_live | — |
| ksmart.ca | May 27, 2026 | ransomware_live | — |
| President Container Group | May 27, 2026 | ransomware_live | — |
| arsenalscaffold.com | May 25, 2026 | ransomware_live | — |
| ennsco.ca | May 25, 2026 | ransomware_live | — |
| sphvalue.com | May 25, 2026 | ransomware_live | — |
| businessrecord.com | May 25, 2026 | ransomware_live | — |
| ggroupcpas.com | May 25, 2026 | ransomware_live | — |
| vegfresh.com | May 25, 2026 | ransomware_live | — |
| saver.nl | May 25, 2026 | ransomware_live | — |
| xtr-global.de | May 25, 2026 | ransomware_live | — |
| allianceadjustment.com | May 25, 2026 | ransomware_live | — |
| jakn.com | May 25, 2026 | ransomware_live | — |
| epbinsurance.com | May 25, 2026 | ransomware_live | — |
| rolser.com | May 25, 2026 | ransomware_live | — |
| Prologic Construction | May 24, 2026 | ransomware_live | — |
| HELIX INTERNATIONAL | May 24, 2026 | ransomware_live | — |
| Heartland Growers | May 24, 2026 | ransomware_live | — |
| Le Pain Quotidien US | May 22, 2026 | ransomware_live | — |
| Vega | May 20, 2026 | ransomware_live | — |
| TAURUS INVESTMENT HOLDINGS | May 19, 2026 | ransomware_live | — |
| ZFG ALTHERM Engineering | May 19, 2026 | ransomware_live | — |
| Ingelan | May 17, 2026 | ransomware_live | — |
| Plan | May 17, 2026 | ransomware_live | — |
| LeRoy Surveyors & Engineers | May 15, 2026 | ransomware_live | — |
| Advanced Medical Consultants | May 14, 2026 | ransomware_live | — |
| AdvancedHEALTH | May 14, 2026 | ransomware_live | — |
| Tricon Infotech | May 13, 2026 | ransomware_live | — |
| Pamil Modulsystem | May 13, 2026 | ransomware_live | — |
| MicroMarketing | May 13, 2026 | ransomware_live | — |
| CMC Expertise Comptable | May 8, 2026 | ransomware_live | — |
| CF Evans Construction | May 8, 2026 | ransomware_live | — |
| Cult Wines | May 4, 2026 | ransomware_live | — |
| rosehillgardens.com | April 27, 2026 | ransomware_live | — |
| gelatissimo.com.au | April 27, 2026 | ransomware_live | — |
| avalonflooring.com | April 27, 2026 | ransomware_live | — |
| mopec.com | April 27, 2026 | ransomware_live | — |
| fatbrands.com | April 27, 2026 | ransomware_live | — |
| andrewtjohnson.com | April 27, 2026 | ransomware_live | — |
| wmsopko.com | April 27, 2026 | ransomware_live | — |
| aotco.com | April 27, 2026 | ransomware_live | — |
| delonhampton.com | April 27, 2026 | ransomware_live | — |
| ibswebsite.com | April 27, 2026 | ransomware_live | — |
| Promotion AB | April 27, 2026 | ransomware_live | — |
| Synmosa Biopharma | April 26, 2026 | ransomware_live | — |
| Primius Law Firm | April 22, 2026 | ransomware_live | — |
| The Galliher Law Firm | April 22, 2026 | ransomware_live | — |
| Champion Homes | April 21, 2026 | ransomware_live | — |
| INCYTE | April 21, 2026 | ransomware_live | — |
| medicalnetworks CJ GmbH & Co. KG | April 17, 2026 | ransomware_live | — |
| bela - pharm | April 15, 2026 | ransomware_live | — |
| McCOR | April 15, 2026 | ransomware_live | — |
| Curtis Design Group | April 15, 2026 | ransomware_live | — |
| Empower Group | April 15, 2026 | ransomware_live | — |
| je-nyc.com | April 14, 2026 | ransomware_live | — |
| ppiplastics.com | April 14, 2026 | ransomware_live | — |
| novafp.com | April 14, 2026 | ransomware_live | — |
| advprograms.com | April 14, 2026 | ransomware_live | — |
| imadesign.com | April 14, 2026 | ransomware_live | — |
| tremcar.com | April 14, 2026 | ransomware_live | — |
| gtlcompany.com | April 14, 2026 | ransomware_live | — |
| graphicinfo.com | April 14, 2026 | ransomware_live | — |
| milliondollarbabyco.com | April 14, 2026 | ransomware_live | — |
| tulsachamber.com | April 14, 2026 | ransomware_live | — |
| breslinbuilders.com | April 14, 2026 | ransomware_live | — |
| Apply Capnor | April 14, 2026 | ransomware_live | — |
| www.sistemigestioneintegrata.eu | April 13, 2026 | ransomware_live | — |
| rudolf-med.com | April 13, 2026 | ransomware_live | — |
| Lift | April 13, 2026 | ransomware_live | — |
| Travel of America | April 13, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).