Dragonforce claims data breach against Hilco Metal Building & Roofing Supply

• Ransomware group: Dragonforce
• Country: United States
• Sector: Manufacturing
• Announcement date: August 30, 2025

Dragonforce claims data breach against Hilco Metal Building & Roofing Supply

The Dragonforce ransomware group has announced a data leak allegedly belonging to Hilco Metal Building & Roofing Supply. According to the group's announcement on their leak site, they claim to possess a significant volume of data stolen from the organization's systems.

Details of the alleged attack

The Dragonforce ransomware group published a leak announcement targeting Hilco Metal Building & Roofing Supply on August 30, 2025. The group claims to have obtained 93.64 GB of data from the organization's systems. While the announcement was made on August 30, 2025, the group has also identified this as the claimed attack date.

In many modern ransomware campaigns, threat actors utilize a method known as double extortion. In this model, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The threat of leaking this stolen information on a public leak site serves as additional leverage to pressure the victim into paying a ransom. In this specific instance, the group has not specified a ransom demand, and no details regarding the specific nature of the data have been provided by the attackers.

Information regarding the leaked data

The leak announcement states that the data size is 93.64 GB. However, the listing does not specify the types of files or the specific categories of data contained within the leak. The announcement does not provide a list of affected data types or specific file formats.

About Hilco Metal Building & Roofing Supply

Hilco Metal Building & Roofing Supply is a company that provides metal buildings, roofing materials, and custom-designed structures for the industrial, oil field, and retail sectors. Based in Texas, the firm serves both commercial and residential projects with products such as barndominiums, fencing supplies, and various construction components.

Potential implications and defensive considerations

The alleged data breach may have negative implications for the organization's operational continuity and commercial reputation. Because the organization operates in the United States, the presence of personal information belonging to customers or employees could trigger state-level data protection laws and notification requirements. The specific legal obligations would depend on the nature of the data and the specific regulations within the relevant jurisdictions.

The fact that the Dragonforce group reportedly employs a model providing infrastructure to affiliates may suggest that their attack vectors could be diverse. Ransomware-as-a-Service (RaaS) models allow different actors to use the same malicious infrastructure, which can lead to a wide variety of entry points and techniques used against targets.

The organization may need to take precautions against secondary risks such as identity theft or targeted phishing attacks that often follow such leaks. Furthermore, the potential for the leaked data to compromise supply chain security should be considered. Organizations facing such threats typically focus on enhancing their monitoring capabilities, implementing strict access controls, and ensuring robust backup strategies to mitigate the impact of both data exfiltration and operational disruption.