Dragonforce claims data breach against Henry Molded Products

• Ransomware group: Dragonforce
• Country: United States
• Sector: Manufacturing
• Announcement date: May 29, 2026

The Dragonforce ransomware group has officially listed the United States-based manufacturing company, Henry Molded Products, on its dedicated leak site. According to the announcement made on May 29, 2026, the threat actor group claims to have successfully executed a cyberattack against the organization, resulting in the unauthorized acquisition of a significant volume of data.

The details of the claim

The Dragonforce group has published a listing alleging a successful data breach targeting Henry Molded Products. While the group has claimed responsibility for the incident, the specific circumstances surrounding the initial entry into the corporate network remain undisclosed. The group has asserted that they have obtained approximately 79.46 GB of data belonging to the organization. Following this claim, the group may have already initiated the process of either publishing the stolen information or attempting to sell it on illicit forums.

In many modern ransomware campaigns, threat actors employ a "double extortion" tactic. This method involves not only encrypting an organization's internal systems to disrupt operations but also exfiltrating sensitive information. The goal is to pressure the victim into paying a ransom by threatening to release the stolen data publicly. By listing a company on a leak site, ransomware groups create public pressure and reputational damage, which serves as a primary lever in their extortion attempts.

Data involved in the incident

Regarding the specific contents of the compromised information, the current listing provides limited visibility. The screenshot provided by the attackers only indicates the company's field of activity and the total size of the data they claim to have stolen. No specific details regarding the types of files or the exact nature of the content shared on the leak site have been provided by the group. The listing names no specific data types.

Summary of claimed data

• Total claimed data size: 79.46 GB

About Henry Molded Products

Henry Molded Products is a manufacturing company specializing in custom molded pulp fiber products and sustainable packaging solutions. They serve industrial and commercial clients by providing eco-friendly, biodegradable, compostable, and recyclable packaging options. As a provider of specialized packaging, the company operates within a critical segment of the manufacturing sector, serving various industrial and commercial clients with sustainable material solutions.

Risk assessment and sector implications

This incident may pose a significant risk of exposure for sensitive corporate data or customer information within Henry Molded Products. Because the company is based in the United States, a potential data breach could lead to complex legal consequences under various state-level data protection laws and federal regulations. Organizations operating in the manufacturing sector must be aware that such breaches can disrupt supply chains and damage long-term business relationships.

The Dragonforce group, which emerged in 2023 and plays an active role in the ransomware ecosystem, appears to adopt a model of providing infrastructure to affiliates. This specific operational model suggests that their attacks can vary significantly in nature and sophistication, as different affiliates may use the infrastructure for different objectives. This variability makes it difficult for defenders to predict the exact tactics, techniques, and procedures used in any single attack.

For organizations and their partners, this incident highlights the necessity of constant vigilance. The company's supply chain partners and customers may need to remain alert against secondary risks that often follow a major data breach, such as targeted phishing campaigns or identity theft attempts. To mitigate these risks, companies in the manufacturing sector often implement defensive measures such as multi-factor authentication, regular security awareness training, and robust network segmentation to prevent lateral movement by attackers.