dragonforce
First seen December 13, 2023Active668 claimed victims
The claims below are reproduced as posted by dragonforce on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Shining Labels | February 13, 2026 | ransomware_live | — |
| SPIR STAR Asia | February 13, 2026 | ransomware_live | — |
| MAIRIE DE FUMEL | February 13, 2026 | ransomware_live | — |
| Betesan | February 13, 2026 | ransomware_live | — |
| A1 Capital | February 12, 2026 | ransomware_live | — |
| Yelete Group Inc | February 12, 2026 | ransomware_live | — |
| Empire Express | February 12, 2026 | ransomware_live | — |
| R.J. Zavoral & Sons, Inc. | February 11, 2026 | ransomware_live | — |
| Atlantic Refinishing & Restoration | February 11, 2026 | ransomware_live | — |
| adelphi.uk.com | February 11, 2026 | ransomware_live | — |
| Esposito Bros. Construction Ltd | February 6, 2026 | ransomware_live | — |
| Perpetuuiti | February 5, 2026 | ransomware_live | — |
| Wayco Inc | February 5, 2026 | ransomware_live | — |
| https://www.platinumdrywall.com/ | February 5, 2026 | ransomware_live | — |
| Heavy Motions Inc | February 5, 2026 | ransomware_live | — |
| Platinum Drywall Inc | February 5, 2026 | ransomware_live | — |
| Erickson Thorpe & Swainston | February 2, 2026 | ransomware_live | — |
| Encompass | February 2, 2026 | ransomware_live | — |
| TIW Group | January 28, 2026 | ransomware_live | — |
| T & M Electric LLC | January 27, 2026 | ransomware_live | — |
| Aegis Project Controls | January 26, 2026 | ransomware_live | — |
| Mullinax Ford | January 25, 2026 | ransomware_live | — |
| www.advancedcoolingtech.us | January 24, 2026 | ransomware_live | — |
| www.hansemerkurintl.com | January 24, 2026 | ransomware_live | — |
| Uinta Bank | January 22, 2026 | ransomware_live | — |
| NWIMS IT Group | January 16, 2026 | ransomware_live | — |
| JR Advertising Specialties | January 16, 2026 | ransomware_live | — |
| 1171 Rue Notre Dame O, Victoriaville, QC G6P 7L1, Canada. (819) 758-0313 | January 15, 2026 | ransomware_live | — |
| SINBON Electronics Co., Ltd | January 2, 2026 | ransomware_live | — |
| UBS Office | January 2, 2026 | ransomware_live | — |
| NK Technologies | December 29, 2025 | ransomware_live | — |
| Burnex | December 29, 2025 | ransomware_live | — |
| Centro Médico Palafox | December 27, 2025 | ransomware_live | — |
| Caramel | December 27, 2025 | ransomware_live | — |
| BMW Guatemala | December 27, 2025 | ransomware_live | — |
| Neurological Associates | December 27, 2025 | ransomware_live | — |
| Barnes & Jones | December 27, 2025 | ransomware_live | — |
| Prime Label | December 24, 2025 | ransomware_live | — |
| Tri-State Metal Roofing Supply | December 24, 2025 | ransomware_live | — |
| National Credit Regulator (NCR) | December 24, 2025 | ransomware_live | — |
| Váhostav | December 21, 2025 | ransomware_live | — |
| Colonial Metals | December 19, 2025 | ransomware_live | — |
| Unipres Alabama Inc. | December 18, 2025 | ransomware_live | — |
| McKee-Pownall Equine Services | December 16, 2025 | ransomware_live | — |
| GPC Industries | December 16, 2025 | ransomware_live | — |
| LiftPRO | December 16, 2025 | ransomware_live | — |
| Edward J Kone | December 16, 2025 | ransomware_live | — |
| Leger & Shaw | December 16, 2025 | ransomware_live | — |
| Amla Commerce | December 16, 2025 | ransomware_live | — |
| Temple Shalom | December 13, 2025 | ransomware_live | — |
| HKR Architects | December 12, 2025 | ransomware_live | — |
| A.S.A.P. Restoration | December 11, 2025 | ransomware_live | — |
| HESCO | December 8, 2025 | ransomware_live | — |
| VoiceTeam Call | December 8, 2025 | ransomware_live | — |
| City of La Vergne | December 8, 2025 | ransomware_live | — |
| Smith Roberts Baldischwiler, LLC | OKC Engineering Firm | December 8, 2025 | ransomware_live | — |
| Jack Levine | December 6, 2025 | ransomware_live | — |
| 3S Software (Secured Smart Systems Overview Metrics) | December 5, 2025 | ransomware_live | — |
| King City Lumber | December 5, 2025 | ransomware_live | — |
| Precision Compounding | December 5, 2025 | ransomware_live | — |
| Capo Brothers | December 3, 2025 | ransomware_live | — |
| Mobilelink USA | December 2, 2025 | ransomware_live | — |
| Capital Star Oil & Gas Inc. | December 2, 2025 | ransomware_live | — |
| Immling Festival DER Festspielort im Chiemgau | December 2, 2025 | ransomware_live | — |
| Basra Transports | December 2, 2025 | ransomware_live | — |
| Division 10 | November 30, 2025 | ransomware_live | — |
| Enerre Pharma Lda | November 27, 2025 | ransomware_live | — |
| Healthcare Retroactive Audits | November 26, 2025 | ransomware_live | — |
| Shelbra International | November 26, 2025 | ransomware_live | — |
| C&M Software | November 22, 2025 | ransomware_live | — |
| F-W-S Countertops | November 22, 2025 | ransomware_live | — |
| Barr Trucking Inc. | November 22, 2025 | ransomware_live | — |
| Healthcare & More | November 22, 2025 | ransomware_live | — |
| Fueling Solutions Inc. | November 22, 2025 | ransomware_live | — |
| Nugent Supply | November 22, 2025 | ransomware_live | — |
| Summit Construction Supply | November 22, 2025 | ransomware_live | — |
| Parsirang | November 22, 2025 | ransomware_live | — |
| Bodega San Huberto | November 22, 2025 | ransomware_live | — |
| Gruenberg Kelly Della | November 21, 2025 | ransomware_live | — |
| Emond Publishing | November 21, 2025 | ransomware_live | — |
| Kettle, Sánchez & Co | November 20, 2025 | ransomware_live | — |
| PAN | November 20, 2025 | ransomware_live | — |
| Du | November 20, 2025 | ransomware_live | — |
| Persians - Cortinas - Todos - Alfombrass | November 13, 2025 | ransomware_live | — |
| Ponzini S.p.A. | November 8, 2025 | ransomware_live | — |
| DCS TECHNOLOGIES INC. | November 7, 2025 | ransomware_live | — |
| GB Mail | November 7, 2025 | ransomware_live | — |
| SAIGON INDUSTRIAL SERVICE | November 5, 2025 | ransomware_live | — |
| G. Hauswirth Architects | November 3, 2025 | ransomware_live | — |
| West Welch Reed Engineers | October 26, 2025 | ransomware_live | — |
| Saturn Machine | October 26, 2025 | ransomware_live | — |
| Latona Trucking | October 26, 2025 | ransomware_live | — |
| Egaraset | October 20, 2025 | ransomware_live | — |
| Integra SAP | October 20, 2025 | ransomware_live | — |
| SERAPHITA GmbH | October 20, 2025 | ransomware_live | — |
| Marmotech | October 18, 2025 | ransomware_live | — |
| Dental Society of La Plata | October 17, 2025 | ransomware_live | — |
| gardiners solicitors | October 17, 2025 | ransomware_live | — |
| José Guma S.A. | October 16, 2025 | ransomware_live | — |
| The Law Offices of Michael C George | October 14, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).