Pantomath Group listed on dragonforce leak site

• Ransomware group: dragonforce
• Country: India
• Sector: Financial Services
• Announcement date: March 4, 2026

The ransomware group known as dragonforce has listed the Indian financial services firm Pantomath Group on its dedicated leak site. According to the announcement made on March 4, 2026, the threat actors claim to have successfully exfiltrated a significant volume of data belonging to the organization.

The claimed attack and event details

The dragonforce group has officially listed Pantomath Group on its leak platform, asserting that they have obtained data belonging to the organization. The threat actor alleges that they have successfully compromised the firm's financial services operations. This type of announcement is a common tactic used by modern ransomware groups to pressure victims into paying ransoms through a method known as double extortion. In such scenarios, attackers not only encrypt a victim's systems but also steal sensitive information, threatening to release it publicly if their demands are not met.

The announcement specifies that a total of 123.6 GB of data has been exfiltrated by the group. While the group has published this information on their leak site, the specific circumstances surrounding the initial entry into the network have not been detailed in the public announcement. Ransomware groups often use these leak sites to build a reputation and to increase the psychological pressure on the targeted organization and its clients.

Data involved in the alleged breach

Regarding the specific contents of the stolen information, the group has not provided any specific details regarding the nature of the leaked data. However, given the firm's operations within the financial services sector, it is possible that sensitive corporate and financial information may be included in the stolen dataset.

The listing does not name any specific data types or individual files that have been compromised. Consequently, the exact scope of the information at risk remains unconfirmed beyond the total volume of data claimed by the attackers.

About Pantomath Group

Pantomath Group is an investment bank that provides a wide range of services, including investment banking, corporate advisory, asset management, and structured finance. The organization serves a diverse clientele, including mid-market businesses, family offices, and various investors. Their operational reach is significant, providing services across more than 12 countries.

Risk assessment and industry implications

This alleged breach may pose a significant risk of exposing corporate and client data due to the nature of Pantomath Group's operations in the financial services sector. The publication of the claimed data could potentially damage the organization's reputation and lead to a loss of client trust. Furthermore, as an organization operating in India, it is likely that legal processes under relevant data protection regulations may be triggered following such an event.

The threat actor, dragonforce, emerged in 2023 and is reported to have adopted a model of providing infrastructure to affiliates. This model allows different actors to use the group's tools and platforms to conduct attacks, which can complicate attribution and defense efforts. Given this operational model, the leaked data may potentially be utilized for secondary extortion or targeted phishing attacks against the organization or its clients.

In the financial services sector, organizations typically focus on robust defensive measures to mitigate such risks. These include implementing multi-factor authentication, maintaining strict network segmentation, and conducting regular security awareness training to prevent phishing. Additionally, maintaining comprehensive, offline backups and adhering to strict data protection regulations are standard industry practices to defend against the evolving landscape of ransomware threats. Public information regarding the dragonforce group remains limited, making it difficult to predict their specific long-term objectives following a leak.