Cheoy Lee Shipyards listed by Dragonforce ransomware group

• Ransomware group: Dragonforce
• Country: Hong Kong SAR China
• Sector: Manufacturing
• Announcement date: June 12, 2026

Dragonforce claims data breach at Cheoy Lee Shipyards

The Dragonforce ransomware group has officially listed Cheoy Lee Shipyards on its dedicated leak site. In this announcement, the threat actor group claims to have successfully compromised the organization and obtained a significant volume of sensitive information. This development marks a potential escalation in the threat landscape facing the maritime manufacturing sector.

The listing, which appeared on June 12, 2026, indicates that the group has initiated a process regarding the publication of the alleged stolen data. This type of activity is characteristic of modern ransomware operations, where attackers use the threat of public data exposure to exert pressure on their targets.

Details of the alleged attack

According to the announcement made by Dragonforce, the group alleges that they have compromised the data belonging to Cheoy Lee Shipyards. The claim was made on June 12, 2026, the same day the attack was reportedly initiated. The group asserts that they have access to a substantial amount of information, specifically claiming a total data size of 610.81 GB.

While the scale of the data is significant, the group has not provided specific details regarding the exact content or the specific types of files that have been exfiltrated. The available information provided by the attackers is limited to the company's general information and the total volume of the data involved. Consequently, the specific nature of the compromised files remains unconfirmed.

• No specific data types were listed in the announcement.

About Cheoy Lee Shipyards

Cheoy Lee Shipyards is a specialized maritime organization focused on the design and manufacturing of a variety of vessels. Their diverse product range includes tugs, ferries, crew boats, and luxury yachts. The company maintains operational facilities in Zhuhai, China, which are capable of producing high-quality vessels with lengths reaching up to 70 meters.

Risk assessment and industry implications

The claim made by the Dragonforce group suggests that there is a significant risk regarding the exposure of the company's operational data and intellectual property. When such data is potentially compromised, organizations often face secondary risks, such as identity theft or targeted phishing attacks directed at their employees or customers. Because the organization is based in Hong Kong, this incident may trigger legal proceedings under local data protection regulations.

It is important to note that Dragonforce operates under a model that provides infrastructure to various affiliates. This operational structure suggests that the actual attack may have been carried out by a different actor using the group's platform. Furthermore, the organization may face risks related to its supply chain security due to the nature of its manufacturing operations.

In general, ransomware groups often employ a 'double extortion' tactic. In this model, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. To defend against such threats, organizations in the manufacturing and maritime sectors typically focus on strengthening their perimeter defenses, implementing strict access controls, and maintaining robust backup solutions. Additionally, monitoring for unauthorized data exfiltration and enhancing supply chain security protocols are critical steps for mitigating the impact of such sophisticated cyber threats.