Mullinax Ford listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: United States
• Sector: Manufacturing
• Announcement date: February 1, 2026

The Mullinax Ford organization has been listed on the leak site associated with the dragonforce ransomware group. According to the claims made by the threat actor, a significant amount of data has been obtained from the company, posing potential risks to the organization and its stakeholders.

Details of the claimed attack

The threat actor known as dragonforce has announced that it has listed data belonging to Mullinax Ford on its dedicated leak site. The incident was discovered on February 1, 2026, although the group has recorded the claimed attack date as January 25, 2026. This timeline suggests that the threat actors may have had access to the environment for several days prior to the public announcement on the leak site.

Ransomware groups often utilize leak sites to exert pressure on victims through a method known as double extortion. In this model, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to threaten its public release. By publishing a victim's name on a leak site, the group aims to damage the organization's reputation and force compliance with ransom demands. While the specific nature of the extortion in this case remains to be fully understood, the listing confirms the group's intent to publicize the breach.

Data involved in the incident

Regarding the specifics of the breach, the dragonforce group has provided limited information concerning the nature of the stolen files. The listing names no specific data types or categories of information that were compromised during the attack.

While the content of the leaked files remains unspecified, the scale of the breach is quantified by the volume of information claimed to be taken. The group asserts that they have obtained 294.65 GB of data from the organization. The lack of detail regarding the specific file types or the exact contents of the 294.65 GB makes it difficult to determine the exact scope of the sensitive information at risk.

Organization profile

Mullinax Ford is an authorized Ford dealership located in Apopka, Florida. The company provides a variety of automotive services, including the sales of new and pre-owned vehicles, financing services, and vehicle maintenance and repair services.

Risk assessment and industry implications

This incident may pose a risk of exposure for customer and employee data held by Mullinax Ford. As the organization operates in the United States, state-level data privacy laws and potential notification requirements may be applicable. The leakage of this data could create secondary risks such as identity theft and targeted phishing attacks for the organization's customers.

Because the dragonforce group reportedly operates using a model that provides infrastructure to affiliates, it is possible that this attack was carried out by different actors using the group's platform. This decentralized approach is common in modern ransomware-as-a-service (RaaS) operations, where core developers provide the tools and the infrastructure, while individual affiliates carry out the actual intrusions.

The organization may face potential reputational damage in addition to operational disruptions. In the automotive and retail sector, maintaining consumer trust is vital, and data breaches can significantly impact customer loyalty. Organizations in this sector can take various defensive steps to mitigate such risks, such as implementing robust multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to prevent initial access via phishing.