DragonForce

Active

678 victims named on the leak site

12 in the last 30 days

382 in the last 12 months

Apr 2023 first victim we recorded

Sep 25, 2026 most recent victim posted

25 leak sites tracked

Data as of October 1, 2026.

Credential exposure before the attack

19.5% of DragonForce victims whose domain we can identify (132 of 678) had employee credentials leak in the 12 months before DragonForce named them as a victim.

We don't know whether any of these credentials were how DragonForce gained initial access.

What industries DragonForce targets

Sector identified for 461 of 678 victims.

Manufacturing	124
Construction	69
Financial Services	49
Healthcare	36
Technology	30
Legal	28
Logistics	23
Education	17

Where the victims are located

Country identified for 476 of 678 victims.

United States	215
United Kingdom	42
Germany	27
Canada	22
Italy	15
Australia	14
France	11
Argentina	9

Most recent DragonForce victims

Victim	Sector	Country	Posted
Arizona Vascular Medical Equipment arizonavascular.com	Healthcare	United States	Sep 25, 2026
Compucase Enterprise hec-group.com.tw	Manufacturing	Taiwan	Sep 25, 2026
Elite Industech pjemetal.com	Manufacturing	Taiwan	Sep 25, 2026
Polyresine polyresine.com	Manufacturing	France	Sep 25, 2026
WinFashion winfashion.com	Technology	Not identified	Sep 25, 2026
ARS Renacer arsrenacer.com	Financial Services	Not identified	Sep 21, 2026
Community Property Management cpm1.com	Real Estate	United States	Sep 17, 2026
Owen Leigh Optometry owenleighoptometry.co.uk	Not identified	United Kingdom	Sep 17, 2026
Medical Department Store medicaldepartmentstore.com	Healthcare	United States	Sep 14, 2026
Homewood Sales homewoodsales.com	Manufacturing	United States	Sep 7, 2026
Norwood Law Firm norwoodlegal.com	Legal	United States	Sep 7, 2026
RubberMill rubbermill.com	Manufacturing	United States	Sep 2, 2026
Brookview Financial brookviewfinancial.com	Not identified	United States	Aug 25, 2026
CRIBA criba.com.ar	Construction	Argentina	Aug 25, 2026
Frato frato.com	Not identified	Portugal	Aug 25, 2026
Wozair wozair.com	Manufacturing	United Kingdom	Aug 25, 2026
Hogan Omidi hoganomidi.com	Legal	United States	Aug 22, 2026
R&D Machine and Engineering rdmachine.com	Manufacturing	United States	Aug 19, 2026
Vermont XCenter vermont.com.br	Not identified	Brazil	Aug 19, 2026
GB Group gbgroup.com	Construction	Not identified	Aug 14, 2026

Showing the 20 most recent of 678. Browse recent data breaches for more.

DragonForce leak sites

Addresses we've seen DragonForce publish victims from. Any .onion address needs the Tor Browser.

z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
dragonforxxbp3awc7mzs5dkswrua3znqyx5roefmi4smjrsdi22xwqd.onion
srpw5frlbymkcarik47ig7zyr6uj7rrxm4fsxdssl5ksyyiksnozy3id.onion
xjhmtitnrdrgzw4vmsghirdoo2fk35a3tzj4enlmah4pvehdspydsiyd.onion
ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion
fwsm2w7jz24gt6p4bjfo6iydksbdf4getctwc2z7ammhch2dyt27drqd.onion
hdwnpou7c2m6whq4vg4zubj5vpd2n565lufinzcktbhsld6gpejdxsad.onion
5n5yhwaytfejyrwglmi6asui3btzo6qnxic3lahxklkt3c6vtg4ticqd.onion
nukxck5zczmf4xjip4jbyqn7ezq5p2xbexfq6tsakdkhsxqpkb6wxbyd.onion
iczam6k5qp4ze2yjbg2u7p6qafoydoeqywheicwog4pujrneguwbnlid.onion
34h7wxmymzntkid2acdak2glyhrdeekne4rnplgfumvwcxfmheu2z2yd.onion
owedofbzetfocjowznfhgjmlwqbzgf4psm7clquqajhuymdou7qvnayd.onion
6faacf2xcsudop4yjvxmx23krl7jtnzue34oajh4plotv6kvnkd7jtqd.onion
l3ljwblw3oufuiizokjwi6btnidco3um6a7u3p5wzz22eddkswi2irqd.onion
5hj4iu4yagandv7erohuuy72lc5ycyhu4vnxeggsmkbh6hqxq3lr6had.onion
d4dywhfvqmhtfjil3oiurj7tvowsp75chymxm6jqfjsxv2k42voguvad.onion
boimv4vphy6whfambjcya5lq2yko4gvhqbgakar6btopuj36zsrm6vqd.onion
dg566uimdj2zcbo6oidl2ckawoamnbz6kjudkwx7hfh2cnyffz3hwlyd.onion
y2i5ar2nxbqjpryvcwfho2pou6nvfgnh2vwpieo2oyl47uhqtbw4naqd.onion
mlg7uog6qxgflhotqvjbxifcwlktil4a3h7oefrq46bh6pkiszhxywyd.onion
mnnpffg2ha4bugkgikeycy7n5a62kibyl7ztyxbnrtxsjecz6q4rmsqd.onion
7p4fwym5bz3teluk4jiwfqqapskykfnj3luy3p2t5jzv7tadwkulkrqd.onion
uioan6yzxl4d5h4l7henupwgsouh44kg3qmfxsi4tv7ffchtvbc7zfqd.onion
olvcyqyaebgbozw3vjbtekyrrwfbjvtqwr7agketxsz5ps4cqezxdwid.onion
37liqfzmm2smh34imw4u4lqdjbbv6ceyhqucjcm4i2363alcbikzmcqd.onion

DragonForce questions

Is DragonForce still active?

Yes. DragonForce posted its most recent victim on September 25, 2026. That's 12 victims in the last 30 days.

How many victims has DragonForce claimed?

DragonForce has named 678 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 382 of them were posted in the last 12 months.

When did DragonForce first appear?

The first victim we recorded for DragonForce was posted on April 6, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does DragonForce target?

Manufacturing accounts for the most victims we can classify, with 124. Construction follows at 69. We could identify a sector for 461 of 678 victims, so treat this as the shape of the targeting rather than a full census.

Has DragonForce already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.