REHA-ACTIV listed on Dragonforce ransomware leak site

• Ransomware group: Dragonforce
• Country: Germany
• Sector: Healthcare
• Announcement date: June 5, 2026

Dragonforce claims data breach at REHA-ACTIV

The ransomware group known as Dragonforce has listed the German medical supply company REHA-ACTIV on its dedicated leak site. According to the announcement made on June 5, 2026, the threat actors claim to have successfully targeted the organization and obtained a significant volume of data from their systems.

The group asserts that they have leaked a dataset totaling 48.55 GB. This claim follows the group's established pattern of using leak sites to pressure organizations by threatening the public release of stolen information. Such tactics are a hallmark of modern ransomware operations, often involving double extortion where data is both encrypted and exfiltrated to increase leverage over the victim.

Details of the alleged attack

The threat actor identified as Dragonforce officially announced the targeting of REHA-ACTIV on June 5, 2026. The group claims to have obtained and subsequently leaked a data set totaling 48.55 GB from the company's internal systems. This announcement serves as the group's method of asserting its successful intrusion into the organization's infrastructure.

Dragonforce is a group that emerged in 2023. It is reported to operate using an affiliate-based model, where the primary group provides the necessary infrastructure for various affiliates to conduct attacks. This decentralized model often leads to a diversification of attack vectors and creates a persistent threat environment for various sectors. By listing the organization on their site, the group claims to have completed a phase of their operation involving the exfiltration of data.

Data involved in the claim

No specific details regarding the content of the allegedly leaked data have been provided by the group. However, given the company's operations in the healthcare sector, it may contain sensitive information.

About REHA-ACTIV

REHA-ACTIV is a medical supply company that has been supporting individuals with health limitations for over 30 years. The company operates in the field of rehabilitation and healthcare products, providing essential services and supplies to those with specific medical needs.

Analysis and potential impact

This alleged leak may pose significant risks to patient privacy and data protection, considering the company's role in the healthcare sector. The sensitive nature of medical and rehabilitation data means that any compromise can have long-lasting implications for the individuals involved. Furthermore, the publication of the alleged data could potentially expose employees and customers to risks such as identity theft or targeted phishing attacks.

Because the company operates in Germany, it may be required to fulfill data breach notification obligations under the General Data Protection Regulation (GDPR). Regulatory frameworks like GDPR are designed to ensure that organizations handle personal data with high levels of security and transparency, especially in the event of a breach.

For organizations operating in the healthcare and medical supply sectors, such incidents highlight the necessity of robust cybersecurity postures. Common defensive steps for organizations facing these threats include implementing strict access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized exfiltration. Additionally, it may be crucial for an organization to initiate a forensic investigation to determine the full scope of the compromised data and ensure that vulnerabilities are remediated to prevent future incursions.