Jan Nygaard listed on DragonForce ransomware leak site

• Ransomware group: DragonForce
• Country: Denmark
• Sector: Manufacturing
• Announcement date: January 25, 2025

DragonForce claims access to Jan Nygaard assets

The threat actor known as DragonForce has announced that it has listed the Danish company Jan Nygaard on its dedicated leak site. According to the announcement made on January 25, 2025, the group claims to have successfully gained access to the digital assets belonging to the organization.

Ransomware groups often utilize leak sites to exert pressure on their victims. These platforms serve as a public stage where threat actors post information about targeted organizations to increase the visibility of the attack. This tactic is frequently associated with double extortion, where attackers not only encrypt an organization's systems but also threaten to release sensitive information to force a ransom payment. In such scenarios, the threat of public exposure is used as a primary lever to motivate the victim to comply with the group's demands.

As of the date of the announcement, the group has not provided detailed information regarding the specific content or the total volume of the data they allege to have exfiltrated from the organization's network.

Details regarding the alleged data breach

At this stage of the incident, there is no information available regarding the specific nature of the allegedly exfiltrated data. The only evidence provided by the threat actor is a screenshot that displays a verification screen used to access the group's leak site.

The listing names no specific data types that have been compromised.

About Jan Nygaard

Jan Nygaard A/S is a company based in Denmark that operates within the industrial machinery and equipment sector. Located in Glostrup, the firm provides specialized services in the field of manufacturing and industrial solutions.

Risk assessment and organizational implications

This incident may pose a significant risk to the operational continuity and the data privacy of Jan Nygaard. Because the organization operates within Denmark, it may be subject to specific legal obligations under the European Union's General Data Protection Regulation (GDPR) regarding the protection of personal information and the notification of breaches.

The claims of a data leak raise the possibility of the disclosure of employee and customer information, which could potentially be used by threat actors in secondary attacks. Such secondary attacks might include targeted phishing campaigns or social engineering attempts directed at the individuals whose data was compromised.

Regarding the threat actor, DragonForce has been active since 2023 and is reported to provide infrastructure to various affiliates. This suggests that the attack on Jan Nygaard could potentially be part of a much broader criminal network. When a group provides infrastructure to affiliates, it indicates a more sophisticated and scalable model of cybercrime.

For organizations in the manufacturing and industrial sectors, such incidents highlight the importance of robust security measures. To mitigate risks, organizations are often encouraged to review their security postures and ensure they are prepared to make necessary notifications regarding potential data breaches to the relevant authorities and affected parties.

General defensive considerations

While specific details of this attack remain limited, organizations facing similar threats typically focus on several defensive pillars:

• Network Segmentation: Limiting the lateral movement of an attacker within a network.
• Data Encryption: Ensuring that even if data is exfiltrated, it remains unreadable to unauthorized parties.
• Continuous Monitoring: Implementing systems to detect unusual patterns of data movement that might indicate exfiltration.
• Incident Response Planning: Maintaining a clear protocol for responding to and communicating a confirmed breach.