Dragonforce ransomware group lists singita.com on its leak site

• Ransomware group: Dragonforce
• Country: South Africa
• Sector: Hospitality
• Announcement date: April 2, 2026

Dragonforce claims data theft from Singita

The Dragonforce ransomware group has officially listed the South African hospitality company singita.com on its dedicated leak site. According to the announcement made on April 2, 2026, the threat actor group claims to have successfully breached the organization's networks and exfiltrated a significant volume of information. The group alleges that the total size of the stolen data amounts to 43.74 GB.

This type of public listing is a hallmark of modern ransomware operations, often referred to as double extortion. In these scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information to use as leverage. By publishing the victim's name and the volume of data stolen on a public leak site, the group aims to exert maximum psychological and reputational pressure on the target to compel them into meeting ransom demands.

The timing of the announcement suggests the attack may have occurred on the same day the listing appeared. While the group has made these claims publicly, it is important to note that these assertions are currently unverified by independent third parties. The group's involvement in providing infrastructure to various affiliates suggests that the actual intrusion might have been executed by different actors working under the Dragonforce umbrella.

Details of the alleged data breach

The Dragonforce group has provided limited specifics regarding the exact nature of the stolen files, but they have released screenshots to support their claims. Based on the visual evidence provided by the attackers, the leaked documents appear to contain sensitive corporate information. Specifically, the shared samples suggest the presence of:

• Financial statements
• Accounting records

The presence of such documents indicates that the breach may have compromised the organization's core operational and financial integrity. When financial and accounting records are targeted, the implications for the company's internal management and external transparency can be profound.

About Singita

Singita is a prominent hospitality company based in South Africa. Since its founding in 1993, the organization has established itself as a key player in the luxury travel sector. The company operates a diverse portfolio of luxury safari lodges, camps, and private villas across various regions throughout Africa. Singita is notably recognized for its commitment to sustainable tourism and its involvement in various wildlife conservation projects, making it a significant entity within the regional hospitality landscape.

Potential impact and organizational implications

The alleged leak of 43.74 GB of data poses a significant risk to Singita, particularly regarding the exposure of operational and financial information. Such a breach can lead to a substantial loss of trust among the company's customers and business partners, who rely on the confidentiality of their interactions with the firm. Furthermore, the exposure of sensitive data may trigger legal proceedings under South Africa's Protection of Personal Information Act (POPIA), which governs how personal data must be handled and protected.

Beyond legal and reputational risks, there is a direct threat to the individuals whose information may have been included in the breach. If personal data was part of the exfiltrated files, those individuals face an increased risk of identity theft and may become targets for highly specific, targeted phishing attacks. These attacks often leverage the stolen information to appear legitimate, making them harder for individuals to detect.

For organizations operating in the hospitality sector, such incidents highlight the necessity of robust cybersecurity frameworks. Following a breach, it is advisable for organizations to take immediate steps to notify all affected parties and conduct a comprehensive security audit of their entire digital infrastructure. Strengthening defensive measures, such as implementing multi-factor authentication, enhancing network monitoring, and conducting regular vulnerability assessments, is essential to mitigate the risk of future incursions by sophisticated ransomware groups.