Grupo DIRIA listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: Costa Rica
• Sector: Hospitality
• Announcement date: August 27, 2025

The Costa Rican hospitality provider Grupo DIRIA has been listed on the leak site of the dragonforce ransomware group. The announcement, which appeared on August 27, 2025, claims that the group has successfully breached the organization's digital infrastructure and exfiltrated a significant volume of data.

The claims made by dragonforce

According to the announcement posted on the dragonforce leak site, the threat actors claim to have gained unauthorized access to the digital infrastructure of Grupo DIRIA. The group alleges that this access allowed them to exfiltrate data belonging to the organization. The claim was officially posted on August 27, 2025, coinciding with the date the group alleges the attack occurred.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms through a method known as double extortion. In this model, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. While the specific details of the intrusion method remain unconfirmed, the listing serves as a public declaration of the group's alleged success in compromising the target's network.

Data involved in the alleged breach

The dragonforce group has specified the scale of the data they claim to have stolen from Grupo DIRIA. However, the listing does not provide granular details regarding the specific types of files or the nature of the information contained within the stolen archives. The following details have been provided by the group:

• Total data size: 148.37 GB

Aside from the total volume of the exfiltrated data, the listing names no specific data types or individual file categories. There is no information available regarding the specific contents of the 148.37 GB of data, nor is there any information regarding a ransom demand or a specific file count.

About Grupo DIRIA

Grupo Diria is a hospitality company operating in Costa Rica. The company provides luxury hotel and resort services located in Tamarindo Beach. The organization aims to provide an authentic Costa Rican experience by combining traditional cultural values with modern comfort for its guests.

Potential impact and organizational risks

This incident may negatively impact Grupo DIRIA's operational continuity and customer trust. If the leaked data includes personal information of guests, legal proceedings under Costa Rica's data protection regulations could be triggered. Furthermore, the fact that the dragonforce group follows a model of providing infrastructure to affiliates suggests that the attack may have been carried out by different actors using the group's platform.

Organizations in the hospitality sector face unique challenges when dealing with such breaches. If the data is verified, risks regarding supply chain security may arise. The organization may need to take precautions against secondary risks such as identity theft and targeted phishing attacks that often follow the exposure of sensitive guest information.

To mitigate such risks, organizations typically focus on strengthening their defensive posture through multi-factor authentication, network segmentation, and continuous monitoring of their digital perimeter. Additionally, maintaining a robust incident response plan is essential for managing the fallout of potential data leaks and ensuring compliance with regional data protection laws.