Ingelan listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: Spain
• Sector: Manufacturing
• Announcement date: May 17, 2026

Ingelan targeted by dragonforce ransomware group

The Spanish engineering solutions provider Ingelan has been listed on the leak site of the dragonforce ransomware group. According to an announcement made on May 17, 2026, the threat actor group claims to have successfully carried out an attack against the organization, resulting in a significant data breach.

The group's claim suggests that the breach occurred on the same day the announcement was posted. While the listing is currently an allegation by the ransomware group, it highlights the ongoing risks faced by specialized engineering firms in the modern threat landscape. Ransomware groups often use these leak sites to pressure victims into paying ransoms by threatening to release sensitive information to the public.

Details of the alleged dragonforce attack

The dragonforce group, which reportedly emerged in 2023, has claimed to have obtained a substantial amount of data belonging to Ingelan. The group is known to operate using a specific business model where they provide the necessary infrastructure and branding to various affiliates, allowing them to scale their operations across different targets.

Regarding the specifics of the breach, the group has not provided a detailed list regarding the content of the leaked data. However, a screenshot associated with the announcement indicates that the total size of the compromised data is approximately 33.92 GB. No specific file counts or ransom demands have been officially disclosed by the group in the current listing.

Data involved in the claim

• The listing names no specific data types.

About Ingelan

Ingelan is a company based in Spain that provides engineering solutions for systems and communications environments. The organization specializes in several critical technical areas, including information systems security, architecture, communications, and plant automation systems. Their focus on high-stakes engineering and automation makes them a significant player in their sector.

Potential implications and industry risks

This alleged leak may pose a risk of exposing Ingelan's trade secrets and operational data. Because the company operates within Spain, the confirmation of such a leak could lead to legal sanctions and administrative fines under the General Data Protection Regulation (GDPR). The nature of the company's work in engineering and automation systems means that the leaked data could potentially be utilized for industrial espionage or supply chain attacks.

Furthermore, if the data includes employee or customer information, it may lead to identity theft or targeted phishing campaigns. Given the operational model of the dragonforce group, it is possible that the leak could be followed by secondary extortion or attempts to sell the data on the dark web.

In such scenarios, organizations in the manufacturing and engineering sectors often face complex challenges. When a breach occurs, companies typically focus on incident response, which includes isolating affected systems to prevent further spread and conducting forensic investigations to determine the scope of the intrusion. Defensive measures generally involve strengthening network segmentation, implementing multi-factor authentication, and maintaining robust backup strategies to mitigate the impact of encryption-based attacks.

The threat of secondary extortion—where attackers demand payment not just for the decryption of files, but also to prevent the release of stolen data—is a common tactic used by modern ransomware groups. This tactic shifts the focus from mere operational disruption to the permanent loss of intellectual property and reputational damage.