RÉSO listed on dragonforce leak site with claims of data theft

• Ransomware group: dragonforce
• Country: France
• Sector: Technology
• Announcement date: October 7, 2026

Dragonforce claims data theft against RÉSO

The French technology company RÉSO has been listed on a leak site by the dragonforce ransomware group. According to the claims made by the threat actors, the organization has fallen victim to a cyberattack resulting in the theft of 676 GB of confidential information. The announcement was made on October 7, 2026, coinciding with the date the group claims the attack occurred.

In the context of modern cybercrime, ransomware groups often utilize leak sites to apply pressure on victims. This tactic is a core component of double extortion, where attackers not only encrypt an organization's systems but also steal sensitive data. By threatening to release this information publicly, the attackers aim to coerce the victim into paying a ransom to prevent the data from being disseminated.

Details of the alleged incident

The dragonforce group asserts that the network belonging to RÉSO has been locked as part of the attack. Furthermore, the group claims that the incident significantly impacted the company's backup infrastructure, specifically stating that approximately 8 TB of Veeam backups were affected. This type of attack on backup systems is particularly damaging, as it aims to undermine the victim's ability to restore operations independently.

The group has stated that the incident occurred after they failed to reach an agreement with the company regarding a ransom payment. This highlights the aggressive nature of the group's extortion model, where a lack of cooperation leads to the public exposure of stolen data.

Affected data types

The group has provided screenshots as evidence, which reportedly display samples of identification cards. According to the claims made by the attackers, the exfiltrated data includes information belonging to various stakeholders, such as:

• Customer data
• Partner data
• Employee data
• Identification card samples

Implications and organizational risks

The claims made by dragonforce pose a significant threat to the operational continuity and data privacy of RÉSO. Because the company operates in France, it is subject to the regulatory framework of the European Union. This means the entity may face mandatory data breach notification requirements and potential administrative fines under the EU General Data Protection Regulation (GDPR).

The alleged theft of identification card samples is particularly concerning, as it may increase the risk of identity theft and targeted phishing attacks against the individuals whose information was compromised. When sensitive identity documents are leaked, the window for fraudulent activity widens, placing a long-term burden on the affected individuals.

Furthermore, the reported impact on backup systems could complicate recovery efforts and create additional pressure for double extortion. The dragonforce group's reported model of providing infrastructure to affiliates may lead to a wider variety of attack vectors and methods, making the threat landscape more complex for organizations to navigate. To defend against such threats, organizations typically focus on robust backup integrity, strict access controls, and comprehensive monitoring to detect exfiltration attempts early.