Accelerator listed on DragonForce ransomware leak site

• Ransomware group: DragonForce
• Country: Norway
• Sector: Transportation
• Announcement date: February 12, 2025

The Norwegian logistics provider Accelerator has been listed on the leak site of the DragonForce ransomware group. The group claims to have carried out a cyberattack against the institution's systems, marking a potential data breach for the organization.

The claimed attack by DragonForce

According to an announcement made on the group's own platform, DragonForce added Accelerator to its leak site on February 12, 2025. The group asserts that they have conducted an action targeting the systems of the Norwegian organization. While the group has made this public claim, the specific details surrounding the execution of the attack remain undisclosed by the threat actors.

Ransomware groups often utilize leak sites to exert pressure on their victims. These platforms serve as a public gallery where groups post the names of organizations they have targeted. In many modern ransomware campaigns, groups employ a double extortion tactic. This method involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information to threaten its public release if a ransom is not paid. By listing a company on a leak site, the group aims to damage the victim's reputation and create urgency through the threat of data exposure.

Details regarding the alleged data breach

Regarding the specifics of the incident, the group has not provided any information concerning the nature or the scope of the allegedly leaked data. There is no information available regarding the total size of the data or the specific number of files involved. The only visual evidence provided in the announcement is a screenshot displaying a verification screen used to access the group's leak site.

• No specific data types or files have been identified in the listing.

About Accelerator

Accelerator AS is a logistics company based in Norway. The organization provides third-party logistics (3PL) services and is 100% Norwegian-owned. The company operates under an owner-led management structure.

Risk assessment and industry implications

This incident may pose significant risks to the operational continuity of an institution operating within the logistics sector. When a logistics provider is targeted, the potential for disruption to supply chains and service delivery is a primary concern. Furthermore, allegations of data leakage can lead to secondary risks, such as identity theft or targeted phishing attacks directed at the institution's employees and its various business partners.

Because the organization operates in Norway, any potential data breaches may be subject to the General Data Protection Regulation (GDPR). Organizations operating within the European Economic Area must adhere to strict protocols regarding the protection of personal data and the timely reporting of breaches to regulatory authorities. Failure to comply with these regulations can result in significant legal and financial consequences.

It is also worth noting that the DragonForce group has been reported to adopt a model of providing infrastructure to affiliates since 2023. Because of this operational model, it is possible that this specific attack may have been carried out by a different actor using the group's infrastructure.

To defend against such threats, organizations in the logistics and transportation sectors typically focus on several defensive layers. This includes implementing robust backup solutions to ensure operational continuity and maintaining strict access controls to limit the movement of unauthorized users within a network. Additionally, continuous monitoring and employee awareness training are essential components in mitigating the risks of phishing and unauthorized data exfiltration.