DragonForce ransomware group lists fgv.br on its leak site

• Ransomware group: DragonForce
• Country: Brazil
• Sector: Education
• Announcement date: March 2, 2026

DragonForce claims a massive data breach at Fundação Getulio Vargas

The Brazil-based educational institution Fundação Getulio Vargas (FGV) has been listed on the leak site of the DragonForce ransomware group. According to an announcement made on March 2, 2026, the group claims to have successfully targeted the institution, which operates under the domain fgv.br. This listing follows a pattern often seen in modern cyberattacks where threat actors use public leak sites to pressure victims by threatening the release of sensitive information.

The DragonForce group has announced a data leak claim against the institution operating under the domain fgv.br. The group claims to have obtained a significant volume of data from the institution's systems. Specifically, the group asserts that they have obtained 1.52 TB of data. The listing includes samples of personnel records that are alleged to belong to the institution's operational processes, serving as evidence of the alleged intrusion.

Details of the alleged data leak

The content of the leak, as presented by the threat actors, includes screenshots that display personnel record documents. These documents allegedly contain both personal and professional information belonging to the institution's employees. The total volume of the alleged leaked data is stated as 1.52 TB, representing a substantial amount of information that could impact the privacy of the individuals involved.

The data types identified in the claim include:

• Employee HR data
• Personnel records

While the group has provided samples of these documents, no specific information was given regarding a ransom demand. The announcement is categorized as a data leak claim rather than a direct negotiation attempt in the initial listing.

About Fundação Getulio Vargas

Fundação Getulio Vargas (FGV) is a prestigious educational and research institution based in Brazil. It offers undergraduate, graduate, and doctoral programs, while also providing technical consulting and academic research for both public and private sectors. Given its role in providing high-level academic and technical services, the institution handles a wide variety of sensitive data related to its students, researchers, and professional staff.

Security implications and organizational risks

This alleged leak may pose a risk for identity theft and targeted phishing attacks due to the exposure of personal information belonging to the institution's employees. When personal and professional details are leaked, attackers can use them to craft highly convincing social engineering campaigns, making it difficult for employees to distinguish between legitimate communications and malicious ones.

Under Brazil's LGPD regulations, it is likely that the institution will be subject to scrutiny regarding its data security processes and data breach notification obligations. Regulatory frameworks like the LGPD are designed to ensure that organizations protect the privacy of individuals and are held accountable when failures occur. Consequently, the institution may need to conduct a comprehensive forensic investigation to determine the scope of the leaked data and notify the affected individuals.

The nature of the threat actor also presents a long-term concern. Given that the DragonForce group is reported to follow a model of providing infrastructure to affiliates, it is assessed that such attacks may be repeated using different methods in the future. This model of cybercrime, often referred to as Ransomware-as-a-Service (RaaS), allows various affiliates to use the same infrastructure to conduct attacks, increasing the frequency and variety of threats facing organizations.

In such scenarios, organizations typically focus on several defensive and reactive steps. This includes implementing robust endpoint detection and response (EDR) systems, maintaining strict access controls, and conducting regular security awareness training for staff to mitigate phishing risks. Furthermore, a rapid incident response plan is essential to contain breaches and minimize the impact of data exfiltration.