Dragonforce ransomware group lists profundo.nl on its leak site

• Ransomware group: Dragonforce
• Country: Netherlands
• Sector: Professional Services
• Announcement date: May 27, 2026

Dragonforce claims data breach at Profundo

The Netherlands-based research organization Profundo has been listed on the leak site of the Dragonforce ransomware group. According to an announcement made on May 27, 2026, the threat actor group alleges that it has successfully gained access to the organization's digital assets.

The Dragonforce group claims to have published approximately 149.31 GB of data, which it asserts belongs to Profundo. While the group has published this information on its dedicated leak site, the full scope and exact nature of the stolen data remains unclear at this time. No information was provided regarding a specific ransom demand or the exact number of files involved in the incident.

Details of the claimed data exposure

The information released by the threat actor includes samples that appear to be sensitive documents. Based on the available screenshots, the leaked material reportedly contains various types of information, including:

• Research documents
• Corporate documents

The presence of these files on a leak site is a common tactic used in double extortion ransomware attacks. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to release this information publicly, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or confidential information.

About Profundo

Profundo is an independent research organization that provides evidence-based research and advisory services to support sustainable development and social justice. The company specializes in conducting sustainability-focused analyses on financial markets and supply chains.

Potential impact and organizational implications

This leak may pose a significant risk of exposing sensitive research data and corporate information within Profundo. Because the organization is based in the Netherlands, the incident could potentially lead to legal consequences under the European Union's General Data Protection Regulation (GDPR). The exposed data might compromise the confidentiality of projects in the sectors where the organization operates and could be utilized for targeted phishing attacks against third parties.

Public information regarding the Dragonforce group is limited. It is reported that the group adopts a model of providing branding and infrastructure to affiliates, a method often seen in modern ransomware-as-a-service operations. In such models, a central group provides the necessary tools and platform, while affiliates carry out the actual attacks.

When facing such incidents, organizations are often required to fulfill data breach notification obligations and inform the affected parties. To mitigate the risks associated with data exfiltration, organizations typically focus on strengthening their perimeter defenses, implementing robust access controls, and maintaining comprehensive monitoring of their digital environments to detect unauthorized access early.