Heartland Growers listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: May 24, 2026

Heartland Growers targeted by dragonforce ransomware group

Heartland Growers, a wholesale greenhouse operation based in Indiana, has been listed on the data leak site of the ransomware group known as dragonforce. The group announced the listing on May 24, 2026, alleging that they have successfully executed a data breach against the organization.

Details of the alleged breach

According to the announcement made via the group's leak portal, dragonforce claims to have gained unauthorized access to the digital assets of Heartland Growers. This type of announcement is a common tactic used by ransomware groups to pressure victims into meeting ransom demands. In many modern cyberattacks, groups employ a "double extortion" model, where they not only encrypt an organization's systems but also steal sensitive information to threaten its public release if the ransom is not paid.

The group's claim of unauthorized access suggests a potential compromise of the organization's internal network or cloud-based environments. While the group has publicized the victim's name on their portal, the specific nature of the intrusion remains unverified through this announcement alone.

Information regarding compromised data

Regarding the specifics of the alleged theft, the group has not provided any details or sample files concerning the nature of the compromised data. The listing does not specify the volume of data taken or the specific types of files that were accessed during the incident. Consequently, the listing names no specific data types.

About Heartland Growers

Heartland Growers is a wholesale greenhouse operation based in Westfield, Indiana. Owned and operated by the Gapinski family since 1984, the company serves a significant role in the regional agricultural supply chain. They supply a variety of plants, including geraniums and lilies, to independent garden centers, florists, and national chain stores throughout the Midwest region.

Risk assessment and industry implications

This incident may pose a risk of exposure for employee or customer data held by Heartland Growers. Because the organization operates within the United States, it may be subject to various state-level data privacy regulations regarding the protection and reporting of personal information. Such regulations often dictate how companies must respond when sensitive data is potentially compromised.

It is important to note that the dragonforce group reportedly utilizes a model that provides infrastructure to affiliates. This means there is a possibility that the attack was executed by a third-party actor using the group's tools and platform. This decentralized model is increasingly common in the ransomware ecosystem, making it difficult to attribute attacks to a single entity.

For organizations operating in the agriculture and food production sector, such incidents highlight the importance of robust cybersecurity frameworks. Supply chain partners and customers of the affected organization should remain vigilant against potential targeted phishing attempts that may result from this alleged breach. Common defensive steps for businesses include implementing multi-factor authentication, maintaining regular offline backups, and conducting employee security awareness training to recognize social engineering attempts.