dragonforce
First seen December 13, 2023Active668 claimed victims
The claims below are reproduced as posted by dragonforce on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| edtg.com | April 13, 2026 | ransomware_live | — |
| Affordable Oil | April 12, 2026 | ransomware_live | — |
| Bit-Wizards | April 7, 2026 | ransomware_live | — |
| AnchorsGordon | April 7, 2026 | ransomware_live | — |
| Innovision Holdings | April 5, 2026 | ransomware_live | — |
| Kopran | April 4, 2026 | ransomware_live | — |
| Vietnam Fortress Tools JSC | April 4, 2026 | ransomware_live | — |
| AUG Pharma | April 4, 2026 | ransomware_live | — |
| G Plants | April 4, 2026 | ransomware_live | — |
| Siam Okamura International Co | April 4, 2026 | ransomware_live | — |
| Asmar Schor & McKenna | April 3, 2026 | ransomware_live | — |
| atpkg.com | April 2, 2026 | ransomware_live | — |
| greenwayfence.com | April 2, 2026 | ransomware_live | — |
| fhw-neukoelln.de | April 2, 2026 | ransomware_live | — |
| sutex.com | April 2, 2026 | ransomware_live | — |
| bunch.ca | April 2, 2026 | ransomware_live | — |
| kleankanteen.com | April 2, 2026 | ransomware_live | — |
| northstarmetal.com | April 2, 2026 | ransomware_live | — |
| acmealliance.com | April 2, 2026 | ransomware_live | — |
| jbrand.co.uk | April 2, 2026 | ransomware_live | — |
| cesimaging.com | April 2, 2026 | ransomware_live | — |
| singita.com | April 2, 2026 | ransomware_live | — |
| First Trinity Financial | April 1, 2026 | ransomware_live | — |
| blossmangas.com | April 1, 2026 | ransomware_live | — |
| Elara Engineering | April 1, 2026 | ransomware_live | — |
| Fountain | April 1, 2026 | ransomware_live | — |
| Alliance Select Foods International | March 29, 2026 | ransomware_live | — |
| Groupe Courtois Automobiles | March 27, 2026 | ransomware_live | — |
| STS Travel | March 27, 2026 | ransomware_live | — |
| pridesol.com | March 26, 2026 | ransomware_live | — |
| kalimaresort.com | March 26, 2026 | ransomware_live | — |
| ssp-ce.de | March 26, 2026 | ransomware_live | — |
| Durable Superior Casters | March 26, 2026 | ransomware_live | — |
| M3 Group | March 24, 2026 | ransomware_live | — |
| Edward Beiner | March 24, 2026 | ransomware_live | — |
| Oriska Insurance | March 20, 2026 | ransomware_live | — |
| odayequipment.com | March 20, 2026 | ransomware_live | — |
| wardencc.com | March 20, 2026 | ransomware_live | — |
| theunlimited.co.za | March 20, 2026 | ransomware_live | — |
| centreconcrete.com | March 20, 2026 | ransomware_live | — |
| liverpoolphil.com | March 20, 2026 | ransomware_live | — |
| sopower.com | March 20, 2026 | ransomware_live | — |
| Health Management Systems | March 19, 2026 | ransomware_live | — |
| vatractor.com | March 19, 2026 | ransomware_live | — |
| Mercedes-Benz of Arlington | March 19, 2026 | ransomware_live | — |
| The Farese Group | March 19, 2026 | ransomware_live | — |
| Edifice Design + Architecture | March 19, 2026 | ransomware_live | — |
| Conrad Capital Management | March 18, 2026 | ransomware_live | — |
| HARTMANN BAU | March 18, 2026 | ransomware_live | — |
| Flexform | March 18, 2026 | ransomware_live | — |
| Dynex/Rivett | March 18, 2026 | ransomware_live | — |
| Construction Equipment Parts | March 18, 2026 | ransomware_live | — |
| gasteiger.design | March 18, 2026 | ransomware_live | — |
| bestgraphics.net | March 17, 2026 | ransomware_live | — |
| phoenixlabs.com | March 13, 2026 | ransomware_live | — |
| [Redacted] Takedown Notice #2054 | March 11, 2026 | ransomware_live | — |
| tazzetti.com | March 10, 2026 | ransomware_live | — |
| maa-architects.com | March 10, 2026 | ransomware_live | — |
| Northern Family Farms | March 7, 2026 | ransomware_live | — |
| salfordcc.ac.uk | March 6, 2026 | ransomware_live | — |
| C.A. LINDMAN Inc. | March 6, 2026 | ransomware_live | — |
| ICS Electrical Services | March 6, 2026 | ransomware_live | — |
| A C Scott Electric | March 6, 2026 | ransomware_live | — |
| North Central HIDTA | March 6, 2026 | ransomware_live | — |
| Advanced Rehabilitation Technology (ART) | March 6, 2026 | ransomware_live | — |
| The Delventhal Company | March 6, 2026 | ransomware_live | — |
| R&C Fence, Inc. | March 6, 2026 | ransomware_live | — |
| Graham County Electric Cooperative | March 6, 2026 | ransomware_live | — |
| Advanced Rehabilitation Technology | March 6, 2026 | ransomware_live | — |
| Bravo Electro Components | March 4, 2026 | ransomware_live | — |
| NEW GENERATION MEDIA | March 4, 2026 | ransomware_live | — |
| Lincoln Green Brewing | March 4, 2026 | ransomware_live | — |
| Pantomath Group | March 4, 2026 | ransomware_live | — |
| AHMED MUBARAK DEBT COLLECTION | March 4, 2026 | ransomware_live | — |
| Öztekin Group | March 4, 2026 | ransomware_live | — |
| Tenteks Tente | March 4, 2026 | ransomware_live | — |
| Environmental Air | March 4, 2026 | ransomware_live | — |
| Minogue Associates | March 3, 2026 | ransomware_live | — |
| Lawrence Journal - World | March 3, 2026 | ransomware_live | — |
| fgv.br | March 2, 2026 | ransomware_live | — |
| ukimportservices.com | March 2, 2026 | ransomware_live | — |
| importservices.co.uk | March 2, 2026 | ransomware_live | — |
| Audexia group | February 27, 2026 | ransomware_live | — |
| Huffman Insurance Agency | February 27, 2026 | ransomware_live | — |
| Jac Vandenberg | February 24, 2026 | ransomware_live | — |
| Middlesex Transporters | February 24, 2026 | ransomware_live | — |
| Hudson Awning | February 24, 2026 | ransomware_live | — |
| Zelenkofske Axelrod | February 23, 2026 | ransomware_live | — |
| Salvatori Group of Companies | February 21, 2026 | ransomware_live | — |
| cepezed.nl | February 19, 2026 | ransomware_live | — |
| fivestates.com | February 19, 2026 | ransomware_live | — |
| CCR Solutions | February 18, 2026 | ransomware_live | — |
| wiproferretto.com | February 16, 2026 | ransomware_live | — |
| mapsweb.com | February 16, 2026 | ransomware_live | — |
| traceenv.com | February 16, 2026 | ransomware_live | — |
| faswealthpartners.com | February 16, 2026 | ransomware_live | — |
| hh2home.com | February 16, 2026 | ransomware_live | — |
| Bigso | February 15, 2026 | ransomware_live | — |
| Elite Screens Inc. | February 13, 2026 | ransomware_live | — |
| Yem Chio Co | February 13, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).