coBuilder listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: Norway
• Sector: Technology
• Announcement date: June 17, 2025

Dragonforce claims data breach against coBuilder

The Norway-based technology company coBuilder has been listed on the leak site of the dragonforce ransomware group. According to an announcement made on June 17, 2025, the threat actor group claims to have successfully targeted the organization and obtained sensitive information. This incident follows a pattern observed in modern cybercrime, where ransomware groups utilize dedicated leak sites to exert pressure on their victims by threatening to publish stolen data.

The group's announcement, which appeared on their platform on the same day as the claimed attack, suggests a significant breach of the company's digital infrastructure. While the listing confirms the group's intent to expose the organization, the specific details regarding the method of entry or the exact nature of the intrusion remain undisclosed by the attackers.

Details of the claimed data theft

The dragonforce group alleges that they have obtained a substantial volume of information belonging to coBuilder. The group claims that the total size of the stolen dataset is 43.07 GB. According to the group's assertions, this stolen information includes the company's complete databases, suggesting a broad impact on their internal data management systems.

Despite the claim that entire databases have been compromised, the announcement does not provide a detailed breakdown of specific data types or individual file contents. The listing names no specific data types within the provided information.

About coBuilder

coBuilder is a technology company that specializes in providing digital solutions specifically tailored for the construction industry. The company's primary objective is to enhance collaboration and increase efficiency throughout the construction value chain. To achieve this, they offer a variety of specialized services, including asset data management, digital product passports, and sustainability reporting.

Risk assessment and industry implications

This incident may present a significant risk of exposure for sensitive corporate data and customer information held within coBuilder. Because the company is based in Norway, the leak could potentially lead to legal repercussions and trigger complex compliance processes under the General Data Protection Regulation (GDPR). The exposure of such data often necessitates rigorous forensic investigations to determine the extent of the privacy violation.

The structure of the dragonforce group, which is known for providing infrastructure to various affiliates, introduces secondary risks. Such a leak may lead to further malicious activities, including identity theft and highly targeted phishing attacks against the company or its stakeholders. Furthermore, because coBuilder maintains an integrated structure with various stakeholders in the construction industry, this incident may pose risks to broader supply chain security.

Based on the past activities of the dragonforce group, the publication of data on leak sites is often followed by increased extortion pressure. In such scenarios, organizations typically focus on incident response, strengthening their network security, and implementing stricter access controls to prevent future unauthorized access. For companies operating in integrated digital sectors, maintaining robust data encryption and continuous monitoring is a common defensive necessity to mitigate the impact of such potential breaches.