Dragonforce ransomware group lists kalimaresort.com on its leak site

• Ransomware group: Dragonforce
• Country: Thailand
• Sector: Hospitality
• Announcement date: March 26, 2026

The Dragonforce ransomware group has listed Kalima Resort & Spa on its dedicated leak site, claiming to have successfully exfiltrated a significant volume of data from the Thailand-based organization. The announcement, made on March 26, 2026, marks a potential data breach involving the luxury hospitality provider.

The claimed attack and event details

According to the threat actor known as Dragonforce, the incident occurred on March 26, 2026. The group alleges that they have gained unauthorized access to the systems of the entity associated with kalimaresort.com. This type of activity is characteristic of modern ransomware operations, where attackers often employ a double extortion tactic. In such scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information to use as leverage during ransom negotiations.

By publishing the name of the victim on a public leak site, ransomware groups aim to exert maximum pressure on the target. The visibility of these listings serves as a psychological tool to damage the reputation of the victim and coerce them into meeting ransom demands. While the group has posted an announcement regarding the breach, they have not provided specific details regarding a ransom demand or the exact method used to penetrate the network.

Data volume and content claims

The Dragonforce group has provided specific metrics regarding the scale of the alleged theft. The group claims to be in possession of 308.51 GB of data. To support their claims, the attackers have shared several document samples on their leak site, which are purported to be part of the exfiltrated dataset. These samples include various screenshots of documents and spreadsheets.

Despite the presentation of these samples, the specific nature and exact contents of the data remain undefined. The listing does not explicitly categorize the files, leaving the exact sensitivity of the information—whether it pertains to internal corporate files, financial records, or guest information—unconfirmed. The listing names no specific data types in a structured format.

The organization profile

Kalima Resort & Spa is a 5-star luxury resort located in Phuket, Thailand, near Patong Beach. The property offers accommodation services for couples and families, featuring rooms, suites, and private villas with sea views.

Risks and industry implications

This claim by the Dragonforce group may pose significant risks to the organization's operational continuity and customer trust. The potential exposure of guest personal information is a primary concern for entities in the hospitality sector. If the alleged leaked data contains sensitive guest details, the organization could face legal consequences under Thailand's Personal Data Protection Act (PDPA).

The threat actor's operational model, which involves providing infrastructure to various affiliates, suggests that attacks can be diverse and unpredictable. This decentralized approach can elevate secondary risks for the victim, as different affiliates may have different motivations or levels of sophistication. For organizations in the hospitality industry, the exposure of customer data can lead to identity theft or targeted phishing campaigns aimed at the resort's clientele.

To mitigate such risks, organizations typically focus on enhancing security measures. This includes implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication (MFA) across all access points, and maintaining rigorous patch management schedules. Furthermore, continuous monitoring and rapid incident response capabilities are essential to detect and contain potential breaches before large volumes of data can be exfiltrated.