dragonforce
First seen December 13, 2023Active668 claimed victims
The claims below are reproduced as posted by dragonforce on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| KraftKisarna | April 14, 2025 | ransomware_live | — |
| Ossman Consultants Limited | April 12, 2025 | ransomware_live | — |
| Statesman Business Advisors | April 11, 2025 | ransomware_live | — |
| Harris Steel | April 9, 2025 | ransomware_live | — |
| Service Trade SpA | April 9, 2025 | ransomware_live | — |
| Miller & Caggiano | April 9, 2025 | ransomware_live | — |
| Coulter & Tateoka | April 7, 2025 | ransomware_live | — |
| Precision Textiles | April 7, 2025 | ransomware_live | — |
| Texla Energy Management | April 4, 2025 | ransomware_live | — |
| IACC Holdings | April 4, 2025 | ransomware_live | — |
| Condista | April 3, 2025 | ransomware_live | — |
| Altara | April 1, 2025 | ransomware_live | — |
| National Electronic Transit (N.E.T) | April 1, 2025 | ransomware_live | — |
| Industrial Dynamics | March 31, 2025 | ransomware_live | — |
| Southern Avionics | March 31, 2025 | ransomware_live | — |
| Talley Metal Fabrication | March 31, 2025 | ransomware_live | — |
| Atlanta Plastic & Reconstructive Specialists | March 31, 2025 | ransomware_live | — |
| Dermatology Solutions | March 31, 2025 | ransomware_live | — |
| PLN | March 31, 2025 | ransomware_live | — |
| Phil Smith Automotive Group | March 29, 2025 | ransomware_live | — |
| architekturbuero-heller.de | March 22, 2025 | ransomware_live | — |
| Colemanmaterials | March 20, 2025 | ransomware_live | — |
| Yadea Group Holdings Ltd | March 17, 2025 | ransomware_live | — |
| DTS -services | March 16, 2025 | ransomware_live | — |
| Moncaro | March 15, 2025 | ransomware_live | — |
| Kleen-Pak Products | March 15, 2025 | ransomware_live | — |
| Thaon-les-Vosges | March 11, 2025 | ransomware_live | — |
| E Leet Woodworking | March 5, 2025 | ransomware_live | — |
| Steel Dynamics UK | March 5, 2025 | ransomware_live | — |
| Vercoe Insurance Brokers | March 5, 2025 | ransomware_live | — |
| Cotswold Fayre | March 5, 2025 | ransomware_live | — |
| GS Floor Designs | February 26, 2025 | ransomware_live | — |
| Tristram European | February 21, 2025 | ransomware_live | — |
| Al Bawani | February 14, 2025 | ransomware_live | — |
| O&S Associates | February 4, 2025 | ransomware_live | — |
| Accelerator | February 4, 2025 | ransomware_live | — |
| Land and Lakes | January 31, 2025 | ransomware_live | — |
| Engineering Design Initiative | January 31, 2025 | ransomware_live | — |
| SCP Building Products | January 31, 2025 | ransomware_live | — |
| Kats, Jamison & Associates | January 31, 2025 | ransomware_live | — |
| USGlobeCorp | January 31, 2025 | ransomware_live | — |
| Farrar Corporation | January 31, 2025 | ransomware_live | — |
| BENASSI IMMOBILIARE SAS DI BENASSI ROBERTO E C. | January 29, 2025 | ransomware_live | — |
| Aquasys | January 27, 2025 | ransomware_live | — |
| Mapping Solutions | January 27, 2025 | ransomware_live | — |
| North American Spares | January 27, 2025 | ransomware_live | — |
| Jan Nygaard | January 25, 2025 | ransomware_live | — |
| Heartcentre | January 24, 2025 | ransomware_live | — |
| Sawley Lock O'Callaghan | January 23, 2025 | ransomware_live | — |
| Angotti & Reilly | January 20, 2025 | ransomware_live | — |
| massdevelopment.com | January 18, 2025 | ransomware_live | — |
| PT PINS Indonesia | January 13, 2025 | ransomware_live | — |
| Asheville Eye Associates | December 28, 2024 | ransomware_live | — |
| Ikav Global Energy | December 28, 2024 | ransomware_live | — |
| Marine Floats | December 14, 2024 | ransomware_live | — |
| Engineered Tower Solutions | December 14, 2024 | ransomware_live | — |
| Williams Tank Lines | December 14, 2024 | ransomware_live | — |
| FINN | December 14, 2024 | ransomware_live | — |
| Cogitis | December 12, 2024 | ransomware_live | — |
| Precision Walls | December 6, 2024 | ransomware_live | — |
| Mobigator Technology Group | November 30, 2024 | ransomware_live | — |
| SUSTA S.r.l. | November 18, 2024 | ransomware_live | — |
| Nunziaplast Srl | November 15, 2024 | ransomware_live | — |
| Scolari | November 2, 2024 | ransomware_live | — |
| Accuracy International | October 25, 2024 | ransomware_live | — |
| Mastery Schools | October 25, 2024 | ransomware_live | — |
| Durham Region | October 14, 2024 | ransomware_live | — |
| Orbit Software, Inc. | October 8, 2024 | ransomware_live | — |
| Lyomark Pharma | October 3, 2024 | ransomware_live | — |
| Graminex | September 23, 2024 | ransomware_live | — |
| Zimmerman & Walsh | September 23, 2024 | ransomware_live | — |
| KGK Group | September 23, 2024 | ransomware_live | — |
| Arc-Com | September 9, 2024 | ransomware_live | — |
| Controlled Power | September 9, 2024 | ransomware_live | — |
| PhD Services | September 5, 2024 | ransomware_live | — |
| Deane Roofing and Cladding | August 22, 2024 | ransomware_live | — |
| Raifalsa-Alelor | August 22, 2024 | ransomware_live | — |
| Igloo Cellulose | August 22, 2024 | ransomware_live | — |
| Sherwood Stainless & Aluminium | August 22, 2024 | ransomware_live | — |
| SMK Ingenieurbüro | August 18, 2024 | ransomware_live | — |
| PER4MANCE | August 18, 2024 | ransomware_live | — |
| J&J Network Engineering | August 17, 2024 | ransomware_live | — |
| Carver Companies | August 17, 2024 | ransomware_live | — |
| Yang Enterprises | August 17, 2024 | ransomware_live | — |
| Cydcor | August 7, 2024 | ransomware_live | — |
| Hayes Beer Distributing | August 2, 2024 | ransomware_live | — |
| David E Shambach Architect | August 2, 2024 | ransomware_live | — |
| CertiCon | July 25, 2024 | ransomware_live | — |
| BK Aerospace | July 25, 2024 | ransomware_live | — |
| John Gallin & Son | July 24, 2024 | ransomware_live | — |
| Dimbleby Funeral Homes | July 24, 2024 | ransomware_live | — |
| SBRPCA | July 16, 2024 | ransomware_live | — |
| Mainland Machinery | July 16, 2024 | ransomware_live | — |
| Raffmetal Spa | July 8, 2024 | ransomware_live | — |
| Vermont Panurgy | July 2, 2024 | ransomware_live | — |
| Gray & Adams | July 2, 2024 | ransomware_live | — |
| Elite Fitness | July 2, 2024 | ransomware_live | — |
| Franciscan Friars of the Atonement | July 2, 2024 | ransomware_live | — |
| Grand Rapids Gravel | July 2, 2024 | ransomware_live | — |
| Hampden Veterinary Hospital | July 1, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).