Ransomware group
Dragonforce ransomware: victims and leak site activity
The Dragonforce ransomware group has listed 664 victims on its leak site since December 2023; its latest post is from 17 October 2026. Most affected countries: United States, United Kingdom and Germany. Most targeted sector: Manufacturing.
Total posts
664
First seen
2023-12-13
Latest post
2026-10-17
Countries hit
66
About Dragonforce
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
- Leak site (Tor)
- http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog
- Profile
- ransomware.live
Most targeted countries
- United States 310
- United Kingdom 47
- Germany 32
- Canada 22
- Italy 19
- Australia 18
- France 13
- Hong Kong 11
- Brazil 10
- India 9
Most targeted sectors
- Manufacturing 147
- Professional Services 147
- Technology 77
- Retail & E-Commerce 46
- Healthcare 45
- Transportation 36
- Agriculture and Food Production 34
- Financial Services 32
- Energy & Utilities 25
- Hospitality 24