Promotion AB listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: Sweden
• Sector: Professional Services
• Announcement date: April 27, 2026

The Swedish professional services firm Promotion AB has been listed on the leak site of the ransomware group known as dragonforce. The threat actor group has claimed to have successfully targeted the organization, alleging that they have obtained a significant volume of internal data.

The alleged attack and claims by dragonforce

According to the announcement published on April 27, 2026, the dragonforce group claims to have gained access to the institution's data. The group has threatened to release the stolen information publicly if their demands are not met. This type of tactic is a hallmark of modern ransomware operations, often referred to as double extortion. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage during negotiations.

The announcement was made on the same day the group claims the attack occurred. While the group has publicized the breach, the specific nature of the data they claim to possess remains undisclosed. The group's presence on a leak site serves as a public pressure tactic designed to damage the reputation of the victim organization and force a settlement.

Details of the claimed data

The dragonforce group has claimed that the volume of data involved in this incident is approximately 157.95 GB. No specific details regarding the nature of the leaked or threatened data have been provided by the attackers, and the listing names no specific data types.

About Promotion AB

Promotion AB is a Swedish company that specializes in providing operational solutions for retail stores. Established in 1979, the company merged with Eclipse Display in 2020. Today, it operates as a specialized partner in the retail management services and in-store display sector, offering various solutions to facilitate retail operations.

Impact and security considerations

This alleged data leak may negatively impact the institution's operational continuity and commercial reputation. Because the organization is based in Sweden, the presence of personal data within the leaked files could lead to legal sanctions and notification obligations under the General Data Protection Regulation (GDPR). The exposure of such data may create secondary risks, such as identity theft or targeted phishing attacks, directed at the organization's employees and business partners.

Furthermore, it is important to consider the operational model of the threat actor. Given that dragonforce is reported to operate a model providing infrastructure to affiliates, the possibility that the attack was carried out by different actors should be considered. This complexity in ransomware ecosystems means that a single group name may represent various independent operators using the same underlying tools and infrastructure.

For organizations operating in the professional services sector, maintaining robust cybersecurity postures is essential to mitigate such risks. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to prevent phishing. Monitoring for unauthorized data exfiltration and ensuring strict access controls can also help reduce the likelihood of a successful breach and subsequent data leak.