DragonForce ransomware group lists edtg.com on its leak site

• Ransomware group: DragonForce
• Country: United States
• Sector: Professional Services
• Announcement date: April 13, 2026

DragonForce claims data breach against Eldorado Trading Group

The threat actor known as DragonForce has listed data allegedly belonging to edtg.com on its leak site. This announcement, made on April 13, 2026, marks a new incident involving the organization. According to the claim, the group has successfully targeted the entity, though the specific nature of the breach remains under investigation.

DragonForce is a ransomware group that emerged in 2023. The group is known to operate using an affiliate model, where they provide the necessary infrastructure to various affiliates to carry out attacks. This decentralized approach is a common tactic in modern cybercrime, as it allows the primary group to scale its operations by delegating the execution of attacks to different partners while maintaining the core technical framework.

Details of the alleged data theft

The announcement made by the threat actor provides limited specifics regarding the contents of the stolen information. While the group has made a public claim regarding the breach, the provided documentation does not contain specific details regarding the nature of the data. The listing specifies only the total volume of the data involved in the incident.

Claimed data metrics

• Total data volume: 25.09 GB

Aside from the total volume of 25.09 GB, no information was given regarding the specific file count or the exact types of files that were allegedly exfiltrated. Furthermore, no ransom demand has been specified in the public announcement.

About Eldorado Trading Group

Eldorado Trading Group (edtg.com) is a company based in California. The organization operates within the banking and financial services industry, a sector that is frequently targeted by cybercriminals due to the sensitive nature of the information handled by such entities.

Potential risks and industry implications

This leak claim may pose significant risks to the organization's operational continuity and commercial reputation. For a US-based entity, a potential data breach could trigger legal processes under relevant state laws and federal regulations. The legal landscape for data protection is complex, and organizations must navigate various compliance requirements when a breach is suspected or confirmed.

Given that the organization operates in the banking sector, the compromised data could potentially be used for identity theft or targeted phishing attacks. In the financial services industry, the integrity of data is paramount, and any loss of confidentiality can lead to long-term consequences for both the company and its clients. The potential for secondary attacks, such as highly targeted social engineering, increases when financial data is involved.

Furthermore, the affiliate model utilized by DragonForce may lead to a wider dissemination of the data across various platforms. Because different affiliates may handle different parts of an attack, the data can end up in multiple locations, making containment and remediation more difficult for the victimized organization. This fragmentation of data increases the risk of the information being sold or leaked multiple times.

In response to such threats, organizations typically need to review their data security protocols and evaluate procedures for notifying affected parties. Common defensive steps for organizations in the financial sector include implementing robust encryption, maintaining strict access controls, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.