Seraphita GmbH data claimed to be leaked by dragonforce

• Ransomware group: dragonforce
• Country: Germany
• Sector: Professional Services
• Announcement date: November 5, 2025

The ransomware group known as dragonforce has claimed responsibility for a data breach involving SERAPHITA GmbH. According to an announcement posted on a leak site on November 5, 2025, the threat actors claim to have exfiltrated a significant volume of data belonging to the organization.

The claimed cyberattack and leak

The threat actor claims to have conducted a cyberattack against SERAPHITA GmbH, resulting in the unauthorized access and subsequent leak of the company's information. The announcement states that the organization's data has been listed on a dedicated leak site, a common tactic used in modern ransomware operations. This method is often associated with double extortion, where attackers not only encrypt an organization's systems but also threaten to release sensitive data to pressure the victim into paying a ransom.

The claim suggests that the breach occurred prior to the public announcement. While the specific details regarding the initial point of entry or the exact nature of the intrusion have not been provided, the scale of the claimed data suggests a comprehensive operation. The threat actor's reported use of an affiliate model implies that the attack may have been executed through a complex infrastructure, as such models allow different actors to collaborate in the execution of large-scale cyber campaigns.

Data involved in the leak

The information released by the threat actor is reported to be substantial in size. The group claims to have leaked 121.2 GB of data. Based on the screenshots and records provided by the attackers, the stolen information appears to be highly sensitive, containing a wide array of financial and personal documentation. The data reportedly includes:

• Tax returns
• Salary certificates
• Balance sheets and income statements
• Pension documents
• Various financial records

The inclusion of such specific documents indicates that the breach targets the core operational and client-facing information of the firm. No information was provided regarding the specific file count or the exact ransom demand associated with this incident.

About SERAPHITA GmbH

SERAPHITA GmbH is an accounting and tax consultancy firm based in Switzerland. The organization provides a variety of professional services to both individual and corporate clients, including tax return preparation, the preparation of financial statements, and general financial advisory services. Given the nature of these services, the firm handles high volumes of sensitive financial and personal data for its clientele.

Risk assessment and organizational implications

The claimed leak may pose a high risk to both the organization and the individuals whose information was contained in the files. Because the data includes financial and personal information, there is a significant risk that the stolen data could be used for identity theft or targeted phishing attacks against the company's clients. Such attacks often leverage the specific details found in financial documents to build trust with the victim.

Furthermore, because the company is based in Germany, it may be subject to legal penalties and regulatory scrutiny under the General Data Protection Regulation (GDPR) depending on the nature of the data involved. The large size of the data suggests a comprehensive breach that could have long-term regulatory and reputational consequences for the firm.

In the professional services sector, organizations can take several defensive steps to mitigate such risks. Implementing robust encryption for data at rest and in transit is a fundamental practice. Additionally, maintaining strict access controls and multi-factor authentication can help prevent unauthorized access to sensitive client files. Regular security audits and comprehensive data protection frameworks are essential for managing the risks associated with handling highly sensitive financial and personal information.