Bigso listed on Dragonforce ransomware leak site

• Ransomware group: Dragonforce
• Country: Sweden
• Sector: Retail & E-Commerce
• Announcement date: February 15, 2026

Dragonforce claims a data breach against Bigso

The threat actor known as Dragonforce has claimed a data breach involving the company Bigso by listing the organization on their leak platform. According to the announcement made on February 15, 2026, the group alleges that they have successfully compromised the organization's systems. This type of announcement is a common tactic used by ransomware groups to pressure victims into paying ransoms by threatening to release sensitive information on public forums.

The incident was officially added to the group's leak site on February 15, 2026. In the announcement, the group included details regarding the company's operations. This practice of providing operational details alongside the breach claim is often intended to validate the attackers' access and increase the pressure on the target organization.

Details of the alleged data theft

While the group has publicized the breach, specific details regarding the exact content of the leaked data remain unavailable. The announcement does not specify the types of files or the nature of the information that has been compromised. The only concrete information provided regarding the stolen material is the total volume of the data.

The group claims the following regarding the stolen data:

• The total size of the alleged stolen data is 100.97 GB.

The absence of specific file types or data categories in the leak site announcement means the full scope of the sensitive information involved cannot be determined from the group's claim alone.

Implications and risks for the organization

This incident may pose significant risks to the organization's operational continuity and data privacy. Depending on the nature of the alleged leaked data, the exposure of employee or customer information could lead to identity theft and targeted phishing attacks. Such attacks often follow a breach, as threat actors use the stolen information to craft highly convincing fraudulent communications to deceive individuals.

Because Bigso is based in Sweden, a potential data breach may trigger legal proceedings and administrative sanctions under the General Data Protection Regulation (GDPR). The regulatory landscape for data protection in Europe is stringent, and organizations found to have insufficient security measures to prevent such leaks can face significant scrutiny and penalties.

Furthermore, the Dragonforce group follows a model of providing infrastructure to affiliates. Because of this operational structure, their attack methods may vary, and secondary extortion attempts might occur. In many ransomware scenarios, attackers may attempt to extort the victim multiple times, first for the decryption of files and subsequently for the promise not to release the stolen data.

General defensive considerations

When facing such threats, organizations typically need to accelerate internal audits to verify the leak claims and inform the relevant data protection authorities. Maintaining robust security protocols is essential for mitigating the impact of such incidents.

Common defensive steps for organizations in the retail and e-commerce sectors include implementing strong access controls, continuous monitoring of network traffic, and ensuring regular, offline backups of critical data. Strengthening employee training to recognize phishing attempts is also a vital component of a modern cybersecurity posture, as human error remains a frequent entry point for ransomware deployment.