Agganis Driving School listed on Dragonforce leak site

• Ransomware group: Dragonforce
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: June 23, 2025

The ransomware group known as Dragonforce has listed Agganis Driving School on its leak site, claiming to possess approximately 15.76 GB of data. This announcement, made on June 23, 2025, marks a potential significant data breach for the institution.

Details of the alleged attack

According to the announcement made on the group's leak site, the attack against Agganis Driving School was reported on June 23, 2025. The group claims that they successfully obtained a substantial amount of information from the institution's internal systems. While the specific method of entry was not detailed in the leak site post, the claim involves a total data volume of 15.76 GB.

Dragonforce is a ransomware group that emerged in 2023. The group operates under a specific business model where they provide branding and infrastructure to various affiliates. This model allows different actors to conduct attacks using the group's established framework, which can complicate threat intelligence efforts and attribution. The use of such a model often means that the infrastructure used for the initial breach and the subsequent data exfiltration is managed by a centralized entity, while the actual exploitation may be carried out by different individuals.

Data involved in the claim

The announcement provided by Dragonforce regarding the stolen information was limited in scope. While the group specified the total size of the alleged theft, they did not provide specific details regarding the content or the types of files contained within the 15.76 GB of data.

• The listing names no specific data types.

In many ransomware incidents, the lack of immediate detail regarding file types is common during the initial stages of a leak. However, the sheer volume of data claimed suggests a significant exfiltration event occurred within the target's network environment.

About Agganis Driving School

Agganis Driving School is an institution that provides driver education programs, road tests, and defensive driving training. With licensed instructors and a fleet of modern vehicles, it offers professional driving education tailored for new and teen drivers. As an organization providing educational and training services, it maintains various records related to its students and operational activities.

Risk assessment and implications

The alleged leak poses several significant risks to the institution, its customers, and its employees. One of the primary concerns is the potential for identity theft and targeted phishing attacks. Because the institution provides educational services, the stolen data may include sensitive personal information, which is a common target for malicious actors seeking to exploit individual identities.

The potential impact of this breach is further complicated by the operational model of the Dragonforce group. Since the group provides infrastructure to affiliates, the leaked data may be misused by various different actors in the cybercrime ecosystem. This increases the likelihood that the information will be redistributed or used for secondary malicious purposes beyond the initial extortion attempt.

Furthermore, the incident highlights the risks associated with the double extortion method. In this tactic, ransomware actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten the public release of that data. This creates immense pressure on the institution, as the threat of a data leak can jeopardize operational continuity and damage the organization's reputation.

Given that the institution is based in the United States, the situation may involve complex legal considerations. State-level data protection laws and potential notification requirements may apply depending on the nature of the data and the residency of the affected individuals. Organizations in the education and service sectors often face these regulatory challenges following a breach. To mitigate such risks, organizations typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining regular offline backups, and conducting regular employee security awareness training to prevent initial access via phishing.