Empower Group listed on dragonforce leak site

• Ransomware group: dragonforce
• Country: United States
• Sector: Professional Services
• Announcement date: April 16, 2026

The threat group known as dragonforce has listed the United States-based organization Empower Group on its leak site. The group claims to have successfully executed a data breach against the firm, alleging that a significant volume of information has been compromised.

Details of the alleged attack

According to the announcement published on April 16, 2026, the threat actor dragonforce alleges that it has obtained 316.38 GB of data belonging to Empower Group. The group claims the attack occurred on April 15, 2026. Dragonforce is a threat actor that emerged in 2023 and is known to operate under a model that provides infrastructure to various affiliates.

Ransomware groups often utilize leak sites to apply pressure on victims through a tactic known as double extortion. In this model, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive data to threaten its public release. By hosting a dedicated leak site, these groups create a public platform to shame organizations and increase the likelihood of a ransom payment. The infrastructure-as-a-service model used by groups like dragonforce allows multiple affiliates to conduct attacks using the group's established resources and branding.

Data involved in the claim

The listing by dragonforce does not provide specific details regarding the nature of the compromised data. No specific information was provided regarding the file count or the specific types of files stolen. However, given the organization's focus on financial services and funding products, it is possible that sensitive client and financial information may be at risk.

• No specific data types were named in the listing.

About Empower Group

Empower Group is a financial services company that partners with various private finance institutions and lenders to meet the working capital needs of businesses. It operates as a hub providing its clients with access to different types of funding products.

Risk assessment and industry implications

This incident may pose a risk of exposure for financial information belonging to Empower Group's clients. Because the organization is based in the United States, a potential data breach could trigger investigations under state-level data protection laws and regulatory bodies. The publication of such data could lead to secondary risks for the organization's clients, including identity theft and targeted phishing attacks.

Furthermore, given the operational model of the dragonforce group, there is a possibility that the leaked data could be exploited by various other threat actors. When data is released on a public leak site, it often enters the broader cybercriminal ecosystem, where it can be used for various fraudulent purposes or sold to other malicious entities.

Organizations operating within the financial services sector face unique challenges when dealing with such incidents. To mitigate the risks of data breaches, companies often implement multi-layered defense strategies. These include robust identity and access management, continuous monitoring of network traffic to detect anomalous behavior, and rigorous encryption protocols for data at rest and in transit. Additionally, maintaining a comprehensive incident response plan is essential for managing the legal, regulatory, and reputational consequences that follow a public disclosure of a breach.

The potential for secondary attacks, such as highly targeted phishing campaigns, remains a significant concern for clients of breached financial institutions. Attackers can use the information gathered during a breach to craft convincing social engineering attempts, making them more effective at tricking individuals into revealing further credentials or transferring funds. Therefore, proactive security measures and ongoing employee awareness training are critical components of a modern cybersecurity posture.