Dragonforce ransomware group claims data breach against PAN

• Ransomware group: Dragonforce
• Country: Japan
• Sector: Retail & E-Commerce
• Announcement date: November 21, 2025

Dragonforce claims to have stolen data from PAN

The Dragonforce ransomware group has announced a targeted attack against the furniture retailer PAN. According to an announcement made on the group's leak site on November 21, 2025, the threat actors claim to have successfully infiltrated the organization's systems. The group asserts that they managed to obtain a significant volume of data during the intrusion, which they claim occurred on November 20, 2025.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information. The attackers then threaten to publish this stolen data on public leak sites if the victim fails to meet specific demands. This method increases the pressure on the target, as the threat of data exposure can cause significant reputational and legal consequences even if the organization can restore its systems from backups.

The group's announcement serves as a public claim of the breach, though the validity of these claims is often difficult to verify independently. Such listings are a common tool used by ransomware groups to exert pressure on their victims and to build a reputation for successfully executing high-impact attacks.

Details of the alleged data leak

The Dragonforce group has provided limited specific details regarding the contents of the stolen information. Based on the information available from the leak site, the group claims to have exfiltrated a total of 16.02 GB of data. While the volume of the data is specified, the group has not provided any specific details regarding the nature of the content or the specific file types involved.

The listing names no specific data types or categories of information.

It is assessed that the stolen data may contain sensitive operational or customer-related information. The lack of clarity regarding the exact content of the 16.02 GB of data makes it difficult to determine the full scope of the potential impact. However, the sheer volume of the data suggests a substantial breach of the organization's digital environment.

About PAN

Pan Emirates Furniture is a United Arab Emirates-based furniture company founded in 1991. The organization specializes in the wholesale and retail of home and office furniture and accessories.

Potential risks and organizational implications

This alleged leak may pose a significant risk to the organization's customer data and trade secrets. The publication of such data could trigger legal proceedings under data protection regulations in the region where the organization operates. Organizations operating in the retail and e-commerce sectors are often subject to strict privacy laws designed to protect consumer information, and a breach of this nature can lead to heavy regulatory scrutiny.

Furthermore, the structure of the Dragonforce group, which provides infrastructure to various affiliates, suggests that the leaked data could be exploited by various different threat actors. This increases the risk of secondary attacks. For the organization's customers, the exposure of personal information can lead to risks such as identity theft and targeted phishing attacks. These secondary risks can persist long after the initial breach has occurred.

Beyond the immediate data risks, such a leak could lead to significant reputational damage and operational disruptions for the entity. For companies in the retail sector, maintaining consumer trust is vital, and a public data leak can erode that trust significantly. To mitigate these risks, organizations typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining strict network segmentation, and conducting regular security awareness training to defend against the initial stages of an attack.