Erickson Thorpe & Swainston listed on Dragonforce leak site

• Ransomware group: Dragonforce
• Country: United States
• Sector: Professional Services
• Announcement date: February 2, 2026

Dragonforce claims data breach at Erickson Thorpe & Swainston

The ransomware group known as Dragonforce has listed the law firm Erickson Thorpe & Swainston on its leak site, claiming a significant data breach has occurred. According to the announcement made on February 2, 2026, the threat actor alleges that they have successfully exfiltrated data from the firm's network. This development follows a pattern of double extortion tactics commonly employed by modern ransomware groups, where stolen information is used as leverage to pressure victims into paying ransoms.

The group's announcement indicates that the breach was identified on February 2, 2026, the same day the listing appeared on their platform. By publishing the organization's name on a dedicated leak site, Dragonforce continues to threaten the public disclosure of the firm's data. Such actions are designed to maximize reputational damage and create public pressure on the targeted entity.

Details of the claimed data exfiltration

The threat actor has provided specific figures regarding the volume of the alleged theft, though they have not provided a specific file count or a ransom demand. The group claims to have obtained 497.47 GB of data from the firm's infrastructure. While the total volume of the data is quantified, the group has not provided specific details regarding the exact content of the allegedly leaked files.

Because the target is a legal practice, the nature of the data is a significant concern. While the listing does not explicitly categorize the files, the professional nature of the organization suggests that the data may contain sensitive client information and various legal documents. The listing names no specific data types in a detailed list.

The target organization

The organization targeted in this incident is Erickson Thorpe & Swainston, a professional services firm operating within the United States. The firm's digital presence is associated with the domain etsreno.com. Given the sensitive nature of legal services, the security of their network is paramount to maintaining professional standards and client trust.

Potential impact and industry implications

The implications of this alleged breach are significant due to the specific sector in which the firm operates. Because Erickson Thorpe & Swainston is a law firm, the leaked data may potentially violate client confidentiality and compromise sensitive legal proceedings. Such a breach can have long-lasting consequences for the legal processes involving the firm's clients.

Furthermore, the exposure of this data could lead to identity theft or targeted phishing attacks against the firm's clients. The group's operational structure, which involves providing infrastructure to various affiliates, may increase the risk of the leak being exploited by a variety of different malicious actors. This decentralized approach makes it difficult for organizations to predict how their data might be used after the initial leak.

As the firm operates in the United States, it may be subject to specific data breach notification requirements mandated by various state laws and federal regulations. In addition to potential legal sanctions, the firm is likely to face substantial reputational damage. Organizations in the professional services sector can mitigate such risks by implementing robust encryption, enforcing strict access controls, and maintaining comprehensive incident response plans to address the complexities of modern ransomware threats.