Barr Trucking Inc. listed on Dragonforce ransomware leak site

• Ransomware group: Dragonforce
• Country: United States
• Sector: Transportation
• Announcement date: November 22, 2025

Dragonforce claims data breach at Barr Trucking Inc.

The threat actor known as Dragonforce has listed Barr Trucking Inc. on its leak site, alleging a data breach. The group claims that 18.19 GB of data belonging to the company has been compromised. This announcement was made on November 22, 2025, the same day the group claims the attack occurred.

Dragonforce is a ransomware group that emerged in 2023. The group reportedly operates under a business model that provides infrastructure to various affiliates. This model is common in the modern ransomware landscape, where specialized groups manage the technical backend and communication channels, allowing affiliates to carry out the actual intrusions and negotiations.

Details of the alleged data theft

Regarding the specific contents of the alleged breach, the provided information does not contain details regarding the nature of the stolen data. The listing only specifies a total data size of 18.19 GB. No specific file counts or ransom demands have been provided in the announcement.

The listing names no specific data types that have been compromised.

About Barr Trucking Inc.

Barr Trucking Inc. is an Illinois-based transportation and logistics company. Founded in 1981, the organization has a long history in the industry. Initially providing water and rock delivery services, the company has since expanded its fleet and focused on commercial trucking operations.

Risk assessment and industry implications

This alleged data breach may pose risks regarding the exposure of employee information, operational records, or commercial data within Barr Trucking Inc. Given that the company is based in the United States, state-level data protection regulations and notification obligations may be applicable to the situation.

Considering the operational model of the Dragonforce group, it is possible that the leaked data could be utilized in secondary attacks or targeted phishing campaigns. Ransomware groups often use stolen information to increase pressure on victims through double extortion tactics, where they threaten to release sensitive data if a ransom is not paid. Even if a ransom is not paid, the data can be used for subsequent fraudulent activities or to damage the reputation of the target organization.

In such scenarios, it is common for organizations to review their data security protocols and evaluate processes for notifying affected parties. For companies operating in the transportation and logistics sector, maintaining robust cybersecurity measures is essential to protect operational continuity and sensitive commercial information from evolving threats.