Jack Levine listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: United States
• Sector: Professional Services
• Announcement date: December 6, 2025

Jack Levine targeted by dragonforce ransomware group

The Miami-based accounting firm Jack Levine has been listed on the leak site of the ransomware group known as dragonforce. According to an announcement published on December 6, 2025, the threat actor claims to have successfully targeted the organization, posing a significant security risk to the firm's ongoing operations.

Details of the claimed attack

The threat actor known as dragonforce has published a listing on its dedicated leak site, claiming that the stolen data belongs to the professional services firm Jack Levine. The group alleges that it has obtained a substantial amount of data from the organization, specifically claiming a total data size of 250.55 GB. This announcement, which appeared on December 6, 2025, marks a potential security incident for the firm.

Ransomware attacks of this nature often involve a tactic known as double extortion. In this model, attackers do not merely encrypt a victim's files to disrupt operations; they also exfiltrate sensitive information before the encryption occurs. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying a ransom. While the specific details regarding the content of the leaked data were not provided by the group, the scale of the alleged theft suggests a significant breach of the organization's digital environment.

Data and potential impact

The listing does not provide specific details regarding the exact content of the leaked data. However, given the nature of the firm's professional services, there is a possibility that sensitive financial information may be included in the alleged theft. Because the entity is an accounting firm, the leaked data may contain client tax returns, banking information, and personally identifiable information.

The potential consequences of such a breach are multifaceted. For the individuals and businesses whose data may have been compromised, there is a heightened risk of identity theft and financial fraud. Furthermore, the organization may face regulatory scrutiny and must navigate state-level data breach notification laws due to its location in the United States. Additionally, the dragonforce group reportedly utilizes a model that provides infrastructure to various affiliates, which suggests that this specific attack may be part of a much broader criminal network.

Potential secondary risks

Beyond the immediate data exposure, organizations facing such threats often deal with secondary risks. For example, the firm's clients may become targets of secondary phishing attacks, which could pose significant risks to overall supply chain security. When sensitive client information is compromised, attackers often use that data to craft highly convincing social engineering campaigns to target the victims directly.

About Jack Levine

Jack Levine PA is a boutique CPA firm based in Miami. The company provides corporate tax and accounting services for businesses, individuals, estates, and non-profit organizations.

Security implications for professional services

This incident highlights the growing risk faced by professional services firms that handle high volumes of sensitive client data. For organizations in the accounting and tax sector, maintaining robust cybersecurity defenses is critical to protecting client trust and ensuring regulatory compliance. Defensive strategies typically involve implementing multi-factor authentication, maintaining rigorous backup protocols, and conducting regular security awareness training for staff to mitigate the risk of phishing.

As threat actors continue to refine their methods, professional services firms must remain vigilant against sophisticated attacks. The involvement of groups that operate via affiliate models increases the frequency and variety of threats that these organizations must defend against. Protecting the integrity of financial and personal data is not only a matter of operational continuity but also a fundamental requirement for maintaining the security of the broader economic supply chain.