BMW Guatemala targeted by Dragonforce ransomware group

• Ransomware group: Dragonforce
• Country: Guatemala
• Sector: Manufacturing
• Announcement date: December 27, 2025

Dragonforce claims data breach at BMW Guatemala

The threat actor known as Dragonforce has published a post on its leak site claiming to target BMW Guatemala. According to the announcement made on December 27, 2025, the group alleges that a significant amount of data belonging to the organization has been compromised. This claim follows a pattern often seen in modern cyberattacks where threat actors use public leak sites to announce their successful intrusions.

The group may be attempting to exert pressure on the organization by threatening to release this data. This tactic is a hallmark of double extortion ransomware models, where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage. By threatening to publish stolen data, attackers aim to coerce the victim into paying a ransom to prevent the public exposure of their proprietary or personal information.

Details of the alleged data theft

The post on the leak site indicates that the volume of the compromised data is approximately 51.42 GB. While the scale of the breach is significant in terms of volume, the specific nature of the information remains unclear. The provided screenshot does not contain specific details regarding the nature of the leaked data or a file list; it only indicates the existence of a 51.42 GB dataset. No specific file types or individual document names were provided in the announcement.

Impacted data types

• The listing names no specific data types.

About BMW Guatemala

BMW Guatemala is an automotive dealership that provides authorized sales and service for BMW vehicles in Guatemala. As a provider of specialized automotive services and sales, the organization handles various business operations essential to the local automotive market.

Risk assessment and organizational implications

This incident may pose risks to the organization's operational continuity and commercial reputation. Depending on the content of the allegedly leaked data, the exposure of employee or customer information could lead to identity theft and targeted phishing attacks. When sensitive datasets are leaked, the resulting loss of trust can have long-lasting effects on a company's relationship with its clientele.

Given that the Dragonforce group emerged in 2023 and is reported to have adopted a model of providing infrastructure to affiliates, the technical complexity of the attack may vary. This model, often referred to as Ransomware-as-a-Service (RaaS), allows different actors to use a centralized infrastructure to conduct attacks, which can make the defense landscape more complex for targeted organizations.

The organization may face legal obligations under data protection regulations in Guatemala and could be required to report a potential data breach. In such scenarios, organizations typically focus on incident response, forensic investigation to determine the exact scope of the breach, and strengthening their security posture to prevent future occurrences. Common defensive steps for organizations in the manufacturing and automotive sectors include implementing robust access controls, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access via phishing.