Dragonforce ransomware group lists gelatissimo.com.au on its leak site

• Ransomware group: Dragonforce
• Country: Australia
• Sector: Hospitality
• Announcement date: April 27, 2026

Dragonforce claims data breach at Gelatissimo

The Dragonforce ransomware group has officially listed the Australian-based organization gelatissimo.com.au on its dedicated leak site. According to the announcement made on April 27, 2026, the threat actors claim to have successfully exfiltrated a significant volume of data from the company's systems. The group asserts that the breach occurred on the same day the announcement was posted, marking a targeted strike against the hospitality brand.

This incident follows a common pattern seen in modern cybercrime known as double extortion. In such scenarios, ransomware groups do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption occurs. By threatening to publish this stolen data on a public leak site, the attackers aim to exert maximum pressure on the victim organization to meet their demands. The presence of a listing on a leak site serves as a public tool for extortion, intended to damage the reputation of the target and force compliance through the threat of exposure.

The scope of the claimed theft

The Dragonforce group claims to have gained unauthorized access to the organization's internal data environment. According to the group's announcement, the total size of the compromised dataset is estimated at 352.42 GB. The attackers allege that this massive collection of information contains critical operational details necessary for the company's day-to-day functions.

While the specific contents of the files are subject to the group's claims, the screenshots provided by the attackers suggest that the stolen information includes various document samples. These samples appear to represent a wide array of internal business materials. The specific categories of data identified in the leak include:

• Financial documents
• Operational data
• Corporate correspondence

The exposure of such documents can lead to significant operational challenges for a company, as internal communications and financial records often contain proprietary strategies and sensitive business intelligence.

About Gelatissimo

Gelatissimo is an Australian-based international ice cream chain that offers artisanal gelato products. The company operates through a franchise model focused on retail and food service, maintaining a presence across various markets through its specialized product offerings.

Potential risks and organizational implications

This incident may pose a risk of exposure for sensitive corporate information within gelatissimo.com.au. Under the Australian Privacy Act, the organization could face regulatory scrutiny if customer or employee data is confirmed to be involved. The leaked information could potentially be exploited by third parties for identity theft or targeted phishing campaigns, as stolen corporate correspondence and financial records often provide the necessary context for highly convincing social engineering attacks.

It is important to note that Dragonforce is reported to operate under a model providing infrastructure to affiliates. This means that while the group claims responsibility, it is possible that the actual attack was executed by different threat actors using the Dragonforce platform. This layer of separation is a common tactic used by ransomware-as-a-service (RaaS) operators to complicate investigations and shield the primary developers from direct attribution.

For organizations operating in the hospitality sector, such incidents highlight the necessity of robust cybersecurity frameworks. To mitigate the impact of such breaches, companies typically need to conduct thorough forensic investigations to determine the full scope of the breach and notify the relevant regulatory authorities. Defensive strategies often include implementing strict access controls, maintaining offline backups, and conducting regular security awareness training to prevent the initial entry of threat actors into the network.