dragonforce ransomware group lists 1171 Rue Notre Dame O, Victoriaville, QC G6P 7L1, Canada. (819) 758-0313 on its leak site

• Ransomware group: dragonforce
• Country: Canada
• Sector: Agriculture and Food Production
• Announcement date: January 15, 2026

Dragonforce claims data theft from Soteck

The ransomware group known as dragonforce has listed the Canadian organization Soteck on its dedicated leak site. According to the announcement made on January 15, 2026, the threat actor group claims to have successfully carried out a cyberattack against the company on the same day the listing appeared.

The group's announcement follows a common pattern in modern cybercrime known as double extortion. In these scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information before the encryption occurs. The threat of releasing this stolen data on a public leak site serves as a secondary layer of pressure on the victim organization to meet ransom demands. While the group has threatened to publish the alleged stolen data, no specific details regarding the content of the leaked files have been provided in the current announcement.

Ransomware leak sites function as a public gallery for victims who refuse to pay. By publishing the names of organizations and the volume of data stolen, these groups aim to maximize the reputational damage and operational pressure on the target. The presence of an organization on such a site is a serious indicator of a potential security incident, though the specific nature of the breach remains to be confirmed by the affected entity.

Details of the alleged data exfiltration

The dragonforce group has made specific claims regarding the scale of the data they have allegedly stolen from Soteck. According to the group's announcement, the total volume of the exfiltrated data is estimated at 1.52 TB. This represents a significant amount of information that, if released, could impact the organization's proprietary data or client information.

Despite the large volume of data claimed by the attackers, the listing provides no specific details regarding the types of files or the specific categories of data that were compromised. The announcement contains only general information regarding the company's profile and the scale of the theft. No information was provided regarding the specific file count or the amount of a ransom demand.

About Soteck

Soteck is a company based in Victoriaville, Quebec, Canada, that specializes in providing engineering solutions for the agriculture and food production sector. The firm has over 25 years of experience in the industry, focusing on delivering operational efficiency and stable production environments for food processing plants across North America.

Their technical expertise covers several critical areas, including air treatment, automation, industrial refrigeration, and energy efficiency. Because their services are integral to the stability of food production environments, their operations are deeply embedded in the industrial infrastructure of the agri-food sector.

Risk assessment and industry implications

The alleged breach of Soteck presents several layers of potential risk. Given the company's role in providing essential engineering solutions for food processing plants, the incident may pose significant risks to operational continuity for their clients. The exposure of technical data related to industrial refrigeration and automation could lead to secondary risks concerning supply chain security, as such information could potentially be used to target the facilities Soteck serves.

Furthermore, as a Canadian entity, Soteck could face legal obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA), depending on the specific nature and sensitivity of the compromised data. Organizations operating in the industrial and engineering sectors should consider several defensive steps to mitigate such risks, including implementing robust network segmentation to protect critical automation systems, maintaining offline backups of essential engineering designs, and conducting regular security audits of their remote access points.

The operational model used by dragonforce, which involves providing infrastructure to various affiliates, suggests that attack vectors can vary widely. This complexity makes it difficult for organizations to predict the specific methods an attacker might use, emphasizing the need for a comprehensive, multi-layered defense strategy that covers both IT and operational technology environments.