Ransomware group
Dragonforce ransomware: victims and leak site activity
The Dragonforce ransomware group has listed 648 victims on its leak site since December 2023; its latest post is from 6 September 2026. Most affected countries: United States, United Kingdom and Germany. Most targeted sector: Professional Services.
Total posts
648
First seen
2023-12-13
Latest post
2026-09-06
Countries hit
65
About Dragonforce
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
Most targeted countries
- United States 305
- United Kingdom 46
- Germany 32
- Canada 21
- Italy 19
- Australia 18
- France 11
- Hong Kong 11
- Brazil 9
- India 9
Most targeted sectors
- Professional Services 147
- Manufacturing 143
- Technology 75
- Retail & E-Commerce 44
- Healthcare 43
- Transportation 36
- Agriculture and Food Production 34
- Financial Services 32
- Energy & Utilities 24
- Hospitality 24