HKR Architects listed on Dragonforce ransomware leak site

• Ransomware group: Dragonforce
• Country: Ireland
• Sector: Professional Services
• Announcement date: December 12, 2025

Dragonforce claims data breach at HKR Architects

The threat actor known as Dragonforce has listed the international architecture and urban design practice HKR Architects on its dedicated leak site. According to the announcement made on December 12, 2025, the group claims to have successfully targeted the organization and obtained a significant volume of data. This development follows a pattern of double extortion, a common ransomware tactic where attackers not only encrypt an organization's systems but also steal sensitive information to use as leverage for ransom demands.

The threat actor's announcement includes specific details regarding the firm's operations, such as the address of its London office. The group has alleged that a total of 134.05 GB of data has been compromised during the attack. While the group has not publicly stated a specific ransom demand in their announcement, they have issued threats to release the stolen data to the public if their demands are not met.

Details of the claimed data theft

The specifics regarding the exact contents of the compromised files remain unconfirmed. No specific details regarding the content of the leaked data have been provided by the threat actor. However, based on the volume of the data, it is assessed that the 134.05 GB dataset may contain architectural designs, corporate documents, or employee information.

The listing names no specific data types in a categorized list, but the sheer scale of the alleged theft suggests a broad impact on the firm's digital assets. In such scenarios, the loss of data can range from administrative files to highly specialized intellectual property.

About HKR Architects

HKR Architects is an international architecture and urban design practice that was founded in 1992. The firm maintains a global presence with established offices in London, Dublin, Dubai, and Abu Dhabi. They provide innovative architectural solutions across a wide variety of sectors, including residential, workplace, hospitality, modular construction, and educational environments.

Potential impact and industry implications

This breach may lead to the exposure of sensitive architectural designs and trade secrets within HKR Architects. Given the regions in which the firm operates, legal sanctions and administrative fines under data protection regulations such as GDPR could be triggered. The potential sale of this data to third parties or its publication in the event of a non-payment could result in significant reputational damage and the disruption of contractual relationships with clients.

Furthermore, the fact that the Dragonforce group employs a model of providing infrastructure to affiliates suggests that the attack may have been coordinated across a wider network. This modular approach to ransomware operations allows threat actors to scale their activities and target diverse industries more efficiently.

If the leaked data includes personal information of employees, it may increase the risk of targeted phishing attacks against the firm's staff. Organizations in the professional services sector often face these risks, where stolen credentials or personal details are used to conduct social engineering attacks. To defend against such threats, organizations typically implement multi-factor authentication, conduct regular security awareness training, and maintain robust, offline backups to mitigate the impact of encryption-based attacks.