Criba listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: Argentina
• Sector: Technology
• Announcement date: August 24, 2026

Criba listed on dragonforce ransomware leak site

The ransomware group known as dragonforce has listed the Argentinian construction firm Criba on its leak site. According to the announcement made by the group, the company has been targeted in a data breach, resulting in the alleged theft of sensitive documentation that was not intended for public disclosure.

Details of the alleged attack

The announcement regarding Criba was published on August 24, 2026. The dragonforce group claims to have successfully exfiltrated data belonging to the organization, characterizing the stolen files as sensitive documentation. The group's claim suggests that the breach involves information related to the company's operations in multiple regions, specifically mentioning its activities in Argentina and Uruguay.

Ransomware attacks often follow a pattern known as double extortion, where threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to leak this information on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the disclosure of proprietary or confidential information. Such leak sites serve as a public gallery for the group's victims, increasing the visibility of the breach to the public and stakeholders.

Alleged data contents

The information claimed to be leaked by dragonforce includes various types of sensitive documentation. The group asserts that the stolen data contains operational details regarding the company's business in Argentina and Uruguay. Specifically, the leaked data is said to include:

• Financial documents
• Client documentation

The presence of such data in a leak can have significant implications for the victim organization. When financial and client-related documents are exposed, it often leads to a loss of trust from business partners and customers who rely on the confidentiality of their information.

About Criba

Criba is an Argentina-based construction company with over 70 years of experience. The firm provides comprehensive solutions for all stages of various architectural projects, including commercial offices, healthcare facilities, and residential buildings.

Impact assessment and industry implications

This alleged data breach may lead to the compromise of the company's trade secrets and client confidentiality. The leaked financial documents could weaken the company's competitive position and potentially facilitate fraudulent activities against third parties. Furthermore, the company may face legal sanctions under Argentine data protection regulations due to the exposure of sensitive information.

The nature of the dragonforce group is notable in the threat landscape; they are reported to provide infrastructure to affiliates. Because of this structure, it is assessed that the scope of the leak could expand and the risk of secondary attacks may increase. When a group operates as an infrastructure provider, it often means that the threat actor's methods and tools are shared across various affiliates, potentially leading to a wider impact across different sectors.

For organizations operating in the construction and technology-adjacent sectors, maintaining robust cybersecurity defenses is essential. Common defensive steps include implementing multi-factor authentication (MFA) across all systems, maintaining regular and offline backups to mitigate the impact of encryption, and conducting regular security awareness training for employees to prevent phishing-based entry. Additionally, organizations should focus on network segmentation to limit the lateral movement of attackers and implement strict access controls to ensure that sensitive financial and client documentation is only accessible to authorized personnel. Monitoring for unusual data exfiltration patterns can also provide early warning signs of a potential breach before data is published on a leak site.