dragonforce
First seen December 13, 2023Active668 claimed victims
The claims below are reproduced as posted by dragonforce on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Super Gardens | July 1, 2024 | ransomware_live | — |
| congoleum.com | June 27, 2024 | ransomware_live | — |
| Oahu Transit Services | June 15, 2024 | ransomware_live | — |
| Seafrigo | June 9, 2024 | ransomware_live | — |
| Hoppecke | June 8, 2024 | ransomware_live | — |
| Parrish-McCall Constructors | June 8, 2024 | ransomware_live | — |
| Barrett Eye Care | June 8, 2024 | ransomware_live | — |
| EvoEvents | June 8, 2024 | ransomware_live | — |
| biremote.net | May 31, 2024 | ransomware_live | — |
| Davis & Young | May 31, 2024 | ransomware_live | — |
| I.L.A. Local 1964 | May 29, 2024 | ransomware_live | — |
| WindCom | May 16, 2024 | ransomware_live | — |
| Dean Lumber & Supply | May 16, 2024 | ransomware_live | — |
| Watt Carmichael | May 14, 2024 | ransomware_live | — |
| Motor Munich | May 14, 2024 | ransomware_live | — |
| Connelly Security Systems | May 14, 2024 | ransomware_live | — |
| Hardings Transport | May 14, 2024 | ransomware_live | — |
| Malone | May 14, 2024 | ransomware_live | — |
| Altipal | May 13, 2024 | ransomware_live | — |
| Persyn | May 13, 2024 | ransomware_live | — |
| Monocon International Refractory | May 13, 2024 | ransomware_live | — |
| Accurate Lock and Hardware | May 13, 2024 | ransomware_live | — |
| Deacon Jones | April 15, 2024 | ransomware_live | — |
| Fullington Trailways | April 15, 2024 | ransomware_live | — |
| Vstblekinge Miljo | April 9, 2024 | ransomware_live | — |
| Rigcon | April 9, 2024 | ransomware_live | — |
| Team Locum | April 9, 2024 | ransomware_live | — |
| MajuHome Concept | April 9, 2024 | ransomware_live | — |
| Swansea & South Wales | April 9, 2024 | ransomware_live | — |
| Saint Cecilia's Church of England School | April 9, 2024 | ransomware_live | — |
| Kadushisoft | April 9, 2024 | ransomware_live | — |
| New Production Concept | April 9, 2024 | ransomware_live | — |
| PalauGov | April 7, 2024 | ransomware_live | — |
| Aussizz Group | April 5, 2024 | ransomware_live | — |
| Teton Orthopaedics | March 25, 2024 | ransomware_live | — |
| Greenline Service | March 25, 2024 | ransomware_live | — |
| Dunbier Boat Trailers | March 25, 2024 | ransomware_live | — |
| Jasper-Dubois County Public Library | March 19, 2024 | ransomware_live | — |
| Ward Transport & Logistics | March 3, 2024 | ransomware_live | — |
| Crystal Window & Door Systems | March 1, 2024 | ransomware_live | — |
| Artissimo Designs | February 29, 2024 | ransomware_live | — |
| Erwat | February 29, 2024 | ransomware_live | — |
| Faison | February 29, 2024 | ransomware_live | — |
| Westward 360 | February 18, 2024 | ransomware_live | — |
| Compression Leasing Services | February 18, 2024 | ransomware_live | — |
| Geologics | December 29, 2023 | ransomware_live | — |
| Ohio Lottery | December 27, 2023 | ransomware_live | — |
| Kinetic Leasing | December 21, 2023 | ransomware_live | — |
| ACE Air Cargo | December 21, 2023 | ransomware_live | — |
| Yakult Australia | December 20, 2023 | ransomware_live | — |
| Greater Cincinnati Behavioral Health | December 13, 2023 | ransomware_live | — |
| Cooper Research Technology | December 13, 2023 | ransomware_live | — |
| Decina | December 13, 2023 | ransomware_live | — |
| Seven Seas | December 13, 2023 | ransomware_live | — |
| Tglt | December 13, 2023 | ransomware_live | — |
| Lunacon Construction Group | December 13, 2023 | ransomware_live | — |
| Dafiti Argentina | December 13, 2023 | ransomware_live | — |
| Baden | December 13, 2023 | ransomware_live | — |
| The GBUAHN | December 13, 2023 | ransomware_live | — |
| World Emblem International | December 13, 2023 | ransomware_live | — |
| Shorts | December 13, 2023 | ransomware_live | — |
| Coca-Cola Singapore | December 13, 2023 | ransomware_live | — |
| Leedarson Lighting | December 13, 2023 | ransomware_live | — |
| Grayhill | December 13, 2023 | ransomware_live | — |
| Agl Welding Supply | December 13, 2023 | ransomware_live | — |
| PCTEL | December 13, 2023 | ransomware_live | — |
| Heart of Texas Region MHMR | December 13, 2023 | ransomware_live | — |
| Pitman Farms | October 20, 2022 | ransomware_live | — |
← NewerPage 7 of 7
Claim data from ransomware.live and RansomLook (CC BY 4.0).