Ransomware group
Dragonforce ransomware: victims and leak site activity
The Dragonforce ransomware group has listed 659 victims on its leak site since December 2023; its latest post is from 7 October 2026. Most affected countries: United States, United Kingdom and Germany. Most targeted sector: Professional Services.
Total posts
659
First seen
2023-12-13
Latest post
2026-10-07
Countries hit
65
About Dragonforce
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
- Leak site (Tor)
- http://xjhmtitnrdrgzw4vmsghirdoo2fk35a3tzj4enlmah4pvehdspydsiyd.onion
- Profile
- ransomware.live
Most targeted countries
- United States 308
- United Kingdom 47
- Germany 32
- Canada 21
- Italy 19
- Australia 18
- France 13
- Hong Kong 11
- Brazil 10
- India 9
Most targeted sectors
- Professional Services 147
- Manufacturing 144
- Technology 76
- Retail & E-Commerce 46
- Healthcare 45
- Transportation 36
- Agriculture and Food Production 34
- Financial Services 32
- Energy & Utilities 25
- Hospitality 24