dragonforce
First seen December 13, 2023Active668 claimed victims
The claims below are reproduced as posted by dragonforce on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Autorotor | October 14, 2025 | ransomware_live | — |
| DragonForce team hurry to notify you about new public available registration panel!\n\http... | October 13, 2025 | ransomware_live | — |
| Fountains Condominium Operations | October 13, 2025 | ransomware_live | — |
| Express Logistics and Distribution Ltd | October 11, 2025 | ransomware_live | — |
| Downes | October 10, 2025 | ransomware_live | — |
| Allgäu Stern Hotel | October 8, 2025 | ransomware_live | — |
| LC Informatique Sàrl | October 8, 2025 | ransomware_live | — |
| Cofiex Asesoría de Empresas, S.L | October 8, 2025 | ransomware_live | — |
| Grupo Serex | October 8, 2025 | ransomware_live | — |
| Cardinal Machinery | September 26, 2025 | ransomware_live | — |
| Memphis Millwork | September 26, 2025 | ransomware_live | — |
| FTCS Forage | September 26, 2025 | ransomware_live | — |
| Rothmann Immobilien | September 26, 2025 | ransomware_live | — |
| Asserson | September 26, 2025 | ransomware_live | — |
| Greenville Legal | September 23, 2025 | ransomware_live | — |
| Concord New Energy Group | September 16, 2025 | ransomware_live | — |
| Engineered Advantage | September 8, 2025 | ransomware_live | — |
| Caprez Ingenieure AG | September 1, 2025 | ransomware_live | — |
| Provalve Armaturen GmbH & Co. KG | August 30, 2025 | ransomware_live | — |
| Toowoomba Friendly Society Dispensary | August 30, 2025 | ransomware_live | — |
| Park Country Club | August 30, 2025 | ransomware_live | — |
| Hilco Metal Building & Roofing Supply | August 30, 2025 | ransomware_live | — |
| ABM Wireless INC | August 30, 2025 | ransomware_live | — |
| Engineered Components | August 30, 2025 | ransomware_live | — |
| Grupo DIRIA | August 27, 2025 | ransomware_live | — |
| The Smile Spa | August 27, 2025 | ransomware_live | — |
| GEA Consulting Engineers | August 23, 2025 | ransomware_live | — |
| Selartex | August 23, 2025 | ransomware_live | — |
| George Haney & Son | August 23, 2025 | ransomware_live | — |
| Dottori Commercialisti Associati | August 23, 2025 | ransomware_live | — |
| Fullcolour.com Limited | August 22, 2025 | ransomware_live | — |
| Sonitrol Security Solutions (SecureFL) | August 21, 2025 | ransomware_live | — |
| Tomb Multimedia Productions | August 21, 2025 | ransomware_live | — |
| IT-Welt und Telekommunikation verschmelzen | August 21, 2025 | ransomware_live | — |
| Krewett | August 21, 2025 | ransomware_live | — |
| InEar hear the difference | August 21, 2025 | ransomware_live | — |
| TechSourceOne IT Solutions Provider | August 21, 2025 | ransomware_live | — |
| fiermann-eller.de | August 21, 2025 | ransomware_live | — |
| Dualinfor hito inovation | August 21, 2025 | ransomware_live | — |
| Diversified Project Services International | August 6, 2025 | ransomware_live | — |
| K2L | August 4, 2025 | ransomware_live | — |
| Koenig Hausverwaltung | August 4, 2025 | ransomware_live | — |
| Wedlich | August 4, 2025 | ransomware_live | — |
| Newton Electrical Contractors | August 4, 2025 | ransomware_live | — |
| Clemens Construction | August 2, 2025 | ransomware_live | — |
| Framon S.p.A. | July 31, 2025 | ransomware_live | — |
| Banco Guanabara | July 30, 2025 | ransomware_live | — |
| Votava Nantz & Johnson | July 28, 2025 | ransomware_live | — |
| Software Design Consulting Group | July 28, 2025 | ransomware_live | — |
| Emerson Chiropractic | July 25, 2025 | ransomware_live | — |
| md-labels-gmbh.com | July 25, 2025 | ransomware_live | — |
| DA Whitacre Construction | July 23, 2025 | ransomware_live | — |
| Burnett and Son Meat | July 16, 2025 | ransomware_live | — |
| Waverly Cabinets | July 16, 2025 | ransomware_live | — |
| Joni L Janecki & Associates | July 16, 2025 | ransomware_live | — |
| Mausolff Immobilien | July 15, 2025 | ransomware_live | — |
| Home Solutions of Iowa | July 15, 2025 | ransomware_live | — |
| Farben-Zentrum Schlegel | July 15, 2025 | ransomware_live | — |
| Greeniverse | July 15, 2025 | ransomware_live | — |
| Belk | July 14, 2025 | ransomware_live | — |
| PPC Mechanical Seals | July 9, 2025 | ransomware_live | — |
| City of Keene, NH | July 7, 2025 | ransomware_live | — |
| Silver Lining Herbs | July 5, 2025 | ransomware_live | — |
| JCC Rockland | July 2, 2025 | ransomware_live | — |
| HKG Duty Free | July 2, 2025 | ransomware_live | — |
| Allegheny Answering Service | July 2, 2025 | ransomware_live | — |
| Cahill Seeds | July 2, 2025 | ransomware_live | — |
| 5àSec | July 2, 2025 | ransomware_live | — |
| Dealmed Medical Supplies | June 26, 2025 | ransomware_live | — |
| Antigo Construction | June 26, 2025 | ransomware_live | — |
| Johnstone Supply Dallas-Fort Worth | June 26, 2025 | ransomware_live | — |
| Pay Tel Communications | June 25, 2025 | ransomware_live | — |
| Brown & Brown PC | June 23, 2025 | ransomware_live | — |
| Brown & Winters | June 23, 2025 | ransomware_live | — |
| Hilliard Enterprises | June 23, 2025 | ransomware_live | — |
| Agganis Driving School | June 23, 2025 | ransomware_live | — |
| Equip'LaboFROID | June 17, 2025 | ransomware_live | — |
| Metropolis Country Club | June 17, 2025 | ransomware_live | — |
| Ess Brothers & Sons | June 17, 2025 | ransomware_live | — |
| Bridgehead | June 17, 2025 | ransomware_live | — |
| Technology Consultants Group | June 17, 2025 | ransomware_live | — |
| coBuilder | June 17, 2025 | ransomware_live | — |
| TSE Industries & WHK Biosystems | June 17, 2025 | ransomware_live | — |
| Alaffia | June 17, 2025 | ransomware_live | — |
| Strait Steel | June 17, 2025 | ransomware_live | — |
| Clayton Construction | June 17, 2025 | ransomware_live | — |
| Trackside Services | June 17, 2025 | ransomware_live | — |
| Pressure Dynamics International | June 17, 2025 | ransomware_live | — |
| Huesman Schmid Insurance Agency | June 17, 2025 | ransomware_live | — |
| TN CPA | June 17, 2025 | ransomware_live | — |
| Strafford County NH | June 16, 2025 | ransomware_live | — |
| AXT | June 16, 2025 | ransomware_live | — |
| Beaumont Products | April 24, 2025 | ransomware_live | — |
| RRS Foodservice | April 22, 2025 | ransomware_live | — |
| Clark Mechanical | April 21, 2025 | ransomware_live | — |
| City of Grove | April 16, 2025 | ransomware_live | — |
| Iris ID | April 16, 2025 | ransomware_live | — |
| Setpoint Systems | April 15, 2025 | ransomware_live | — |
| Pratt Homes | April 14, 2025 | ransomware_live | — |
| Pryor Morrow | April 14, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).