Dragonforce ransomware group lists momenta.cn on its leak site

• Ransomware group: Dragonforce
• Country: China
• Sector: Technology
• Announcement date: July 14, 2026

The Dragonforce ransomware group has officially listed the technology company Momenta on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully exfiltrated sensitive data belonging to the organization.

The claimed attack and impact

The listing was announced on July 14, 2026. Through this announcement, the Dragonforce group alleges that they have successfully compromised the target's infrastructure. Specifically, the threat actors claim that the company's servers and workstations have been encrypted, a hallmark of ransomware attacks designed to disrupt business operations.

In addition to the encryption of systems, the group alleges that they have gained unauthorized access to critical internal files. The group's claims suggest that the breach extends beyond simple system lockout, involving the compromise of sensitive databases and financial documentation. While the group has posted the company's name on their platform, it is important to note that no screenshots were provided to support the claims in the announcement.

Data allegedly compromised in the breach

The announcement made by the Dragonforce group specifies several categories of stolen information. According to the group's claims, the following types of data have been exfiltrated from the organization:

• Source code
• Financial documents
• Configuration files
• Employee database

The specific volume of the stolen data, including the total number of files and the exact size of the exfiltrated datasets, remains unknown as no information was provided regarding these metrics. Furthermore, no ransom demand has been publicly stated by the group in relation to this specific incident.

About Momenta

Momenta is a technology company based in China. The organization specializes in the development of autonomous driving technologies and AI-based solutions. Their technical focus includes the creation of intelligent driving software and the development of Level 4 autonomous driving systems.

Risk assessment and industry implications

This incident, as claimed by the threat actor, may pose significant risks to the company's operational continuity and the security of its intellectual property. The nature of the data allegedly stolen—particularly the source code and configuration files—could lead to a loss of the company's competitive advantage in the highly specialized autonomous driving sector. Additionally, the alleged theft of an employee database could lead to risks of identity theft for the individuals involved.

The disclosure of financial documents may also have broader consequences, potentially undermining investor confidence and potentially triggering investigations by regulatory bodies. Given that the company is based in China, legal processes under local data protection regulations may be initiated following such an event.

The Dragonforce group, which emerged in 2023, is believed to operate under a model that provides infrastructure to various affiliates. This type of model is common in the modern ransomware landscape, where specialized groups provide the technical framework for other actors to carry out attacks.

For organizations operating in high-tech sectors involving sensitive intellectual property, such as autonomous driving and artificial intelligence, these types of incidents highlight the critical importance of robust cybersecurity frameworks. Defensive strategies typically involve implementing strict access controls, maintaining offline backups, and continuous monitoring of network traffic to detect unauthorized exfiltration. Protecting the integrity of source code and sensitive employee data is essential for maintaining both market position and regulatory compliance.