dragonforce
First seen December 13, 2023Active648 claimed victims
The claims below are reproduced as posted by dragonforce on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Aegis Project Controls | January 26, 2026 | ransomware_live | — |
| Mullinax Ford | January 25, 2026 | ransomware_live | — |
| www.advancedcoolingtech.us | January 24, 2026 | ransomware_live | — |
| www.hansemerkurintl.com | January 24, 2026 | ransomware_live | — |
| Uinta Bank | January 22, 2026 | ransomware_live | — |
| NWIMS IT Group | January 16, 2026 | ransomware_live | — |
| JR Advertising Specialties | January 16, 2026 | ransomware_live | — |
| 1171 Rue Notre Dame O, Victoriaville, QC G6P 7L1, Canada. (819) 758-0313 | January 15, 2026 | ransomware_live | — |
| SINBON Electronics Co., Ltd | January 2, 2026 | ransomware_live | — |
| UBS Office | January 2, 2026 | ransomware_live | — |
| NK Technologies | December 29, 2025 | ransomware_live | — |
| Burnex | December 29, 2025 | ransomware_live | — |
| Centro Médico Palafox | December 27, 2025 | ransomware_live | — |
| Caramel | December 27, 2025 | ransomware_live | — |
| BMW Guatemala | December 27, 2025 | ransomware_live | — |
| Neurological Associates | December 27, 2025 | ransomware_live | — |
| Barnes & Jones | December 27, 2025 | ransomware_live | — |
| Prime Label | December 24, 2025 | ransomware_live | — |
| Tri-State Metal Roofing Supply | December 24, 2025 | ransomware_live | — |
| National Credit Regulator (NCR) | December 24, 2025 | ransomware_live | — |
| Váhostav | December 21, 2025 | ransomware_live | — |
| Colonial Metals | December 19, 2025 | ransomware_live | — |
| Unipres Alabama Inc. | December 18, 2025 | ransomware_live | — |
| McKee-Pownall Equine Services | December 16, 2025 | ransomware_live | — |
| GPC Industries | December 16, 2025 | ransomware_live | — |
| LiftPRO | December 16, 2025 | ransomware_live | — |
| Edward J Kone | December 16, 2025 | ransomware_live | — |
| Leger & Shaw | December 16, 2025 | ransomware_live | — |
| Amla Commerce | December 16, 2025 | ransomware_live | — |
| Temple Shalom | December 13, 2025 | ransomware_live | — |
| HKR Architects | December 12, 2025 | ransomware_live | — |
| A.S.A.P. Restoration | December 11, 2025 | ransomware_live | — |
| HESCO | December 8, 2025 | ransomware_live | — |
| VoiceTeam Call | December 8, 2025 | ransomware_live | — |
| City of La Vergne | December 8, 2025 | ransomware_live | — |
| Smith Roberts Baldischwiler, LLC | OKC Engineering Firm | December 8, 2025 | ransomware_live | — |
| Jack Levine | December 6, 2025 | ransomware_live | — |
| 3S Software (Secured Smart Systems Overview Metrics) | December 5, 2025 | ransomware_live | — |
| King City Lumber | December 5, 2025 | ransomware_live | — |
| Precision Compounding | December 5, 2025 | ransomware_live | — |
| Capo Brothers | December 3, 2025 | ransomware_live | — |
| Mobilelink USA | December 2, 2025 | ransomware_live | — |
| Capital Star Oil & Gas Inc. | December 2, 2025 | ransomware_live | — |
| Immling Festival DER Festspielort im Chiemgau | December 2, 2025 | ransomware_live | — |
| Basra Transports | December 2, 2025 | ransomware_live | — |
| Division 10 | November 30, 2025 | ransomware_live | — |
| Enerre Pharma Lda | November 27, 2025 | ransomware_live | — |
| Healthcare Retroactive Audits | November 26, 2025 | ransomware_live | — |
| Shelbra International | November 26, 2025 | ransomware_live | — |
| C&M Software | November 22, 2025 | ransomware_live | — |
| F-W-S Countertops | November 22, 2025 | ransomware_live | — |
| Barr Trucking Inc. | November 22, 2025 | ransomware_live | — |
| Healthcare & More | November 22, 2025 | ransomware_live | — |
| Fueling Solutions Inc. | November 22, 2025 | ransomware_live | — |
| Nugent Supply | November 22, 2025 | ransomware_live | — |
| Summit Construction Supply | November 22, 2025 | ransomware_live | — |
| Parsirang | November 22, 2025 | ransomware_live | — |
| Bodega San Huberto | November 22, 2025 | ransomware_live | — |
| Gruenberg Kelly Della | November 21, 2025 | ransomware_live | — |
| Emond Publishing | November 21, 2025 | ransomware_live | — |
| Kettle, Sánchez & Co | November 20, 2025 | ransomware_live | — |
| PAN | November 20, 2025 | ransomware_live | — |
| Du | November 20, 2025 | ransomware_live | — |
| Persians - Cortinas - Todos - Alfombrass | November 13, 2025 | ransomware_live | — |
| Ponzini S.p.A. | November 8, 2025 | ransomware_live | — |
| DCS TECHNOLOGIES INC. | November 7, 2025 | ransomware_live | — |
| GB Mail | November 7, 2025 | ransomware_live | — |
| SAIGON INDUSTRIAL SERVICE | November 5, 2025 | ransomware_live | — |
| G. Hauswirth Architects | November 3, 2025 | ransomware_live | — |
| West Welch Reed Engineers | October 26, 2025 | ransomware_live | — |
| Saturn Machine | October 26, 2025 | ransomware_live | — |
| Latona Trucking | October 26, 2025 | ransomware_live | — |
| Egaraset | October 20, 2025 | ransomware_live | — |
| Integra SAP | October 20, 2025 | ransomware_live | — |
| SERAPHITA GmbH | October 20, 2025 | ransomware_live | — |
| Marmotech | October 18, 2025 | ransomware_live | — |
| Dental Society of La Plata | October 17, 2025 | ransomware_live | — |
| gardiners solicitors | October 17, 2025 | ransomware_live | — |
| José Guma S.A. | October 16, 2025 | ransomware_live | — |
| The Law Offices of Michael C George | October 14, 2025 | ransomware_live | — |
| Autorotor | October 14, 2025 | ransomware_live | — |
| DragonForce team hurry to notify you about new public available registration panel!\n\http... | October 13, 2025 | ransomware_live | — |
| Fountains Condominium Operations | October 13, 2025 | ransomware_live | — |
| Express Logistics and Distribution Ltd | October 11, 2025 | ransomware_live | — |
| Downes | October 10, 2025 | ransomware_live | — |
| Allgäu Stern Hotel | October 8, 2025 | ransomware_live | — |
| LC Informatique Sàrl | October 8, 2025 | ransomware_live | — |
| Cofiex Asesoría de Empresas, S.L | October 8, 2025 | ransomware_live | — |
| Grupo Serex | October 8, 2025 | ransomware_live | — |
| Cardinal Machinery | September 26, 2025 | ransomware_live | — |
| Memphis Millwork | September 26, 2025 | ransomware_live | — |
| FTCS Forage | September 26, 2025 | ransomware_live | — |
| Rothmann Immobilien | September 26, 2025 | ransomware_live | — |
| Asserson | September 26, 2025 | ransomware_live | — |
| Greenville Legal | September 23, 2025 | ransomware_live | — |
| Concord New Energy Group | September 16, 2025 | ransomware_live | — |
| Engineered Advantage | September 8, 2025 | ransomware_live | — |
| Caprez Ingenieure AG | September 1, 2025 | ransomware_live | — |
| Provalve Armaturen GmbH & Co. KG | August 30, 2025 | ransomware_live | — |
| Toowoomba Friendly Society Dispensary | August 30, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).