Skip to content
Ransomware

SETS Solutions listed on dragonforce ransomware leak site

Lebanon-based technology company SETS Solutions has been listed on the leak site of the dragonforce ransomware group.

By
Siberpol Intelligence Unit
Published
3 min read
3 min read
  • Ransomware group: dragonforce
  • Country: Lebanon
  • Sector: Professional Services
  • Announcement date: June 3, 2026

The Lebanon-based technology company SETS Solutions has been listed on the leak site of the dragonforce ransomware group. The threat actor group has made a public announcement claiming to have successfully breached the organization's systems and exfiltrated a significant volume of data.

The claimed attack and event details

According to the announcement made on June 3, 2026, the dragonforce group alleges that they have gained unauthorized access to the internal systems of SETS Solutions. The group claims to have completed the exfiltration process, leading to the publication of the organization on their dedicated leak site. This type of activity is a hallmark of modern ransomware operations, often referred to as double extortion, where attackers not only encrypt an organization's data but also threaten to release sensitive information publicly to increase pressure for ransom payments.

While the group has posted a listing, it is important to note that these claims are made by the threat actors themselves. The group's announcement serves as a public claim of a successful breach and data theft, though the specific mechanics of how the initial access was achieved remain undisclosed in the public announcement.

Data involved in the alleged breach

The dragonforce group has published what they claim to be 19.5 GB of data belonging to SETS Solutions. Despite the significant size of the dataset mentioned in the announcement, no specific details regarding the content of the allegedly leaked data have been provided. The evidence provided by the group consists of a screenshot that only indicates the presence of a 19.5 GB dataset, without specifying the types of files or the nature of the information contained within.

  • The listing names no specific data types.

The absence of specific file descriptions or data categories means that the exact nature of the information—whether it consists of corporate documents, technical configurations, or personal identifiers—remains unconfirmed by the group's public post.

About SETS Solutions

SETS Solutions is a technology company that has been operating in the Middle East since 1990. The organization is best known for its Human Resources Management System, known as People365. Beyond HR software, the company provides a wide range of professional services, including data center solutions, security, cloud computing, and end-user computing.

Risk assessment and implications

This leak claim may bring the risk of exposure for corporate data and sensitive information belonging to the clients of SETS Solutions. Given that the company provides critical systems such as human resources and payroll management, the breach could potentially impact supply chain security. When a service provider handling sensitive administrative functions is targeted, the downstream effects can reach many of the organizations that rely on their platforms for daily operations.

The fact that the dragonforce group adopts a model of providing infrastructure to affiliates may suggest that the attack could have been carried out by different actors using the group's platform. This modular approach to cybercrime complicates attribution and investigation. Furthermore, the breach could potentially lead to legal and operational consequences under the data protection regulations in the region where the company operates.

Secondary risks associated with such a breach may include the use of the leaked data for identity theft or targeted phishing attacks. Organizations in the professional services sector often face these risks when sensitive client information is compromised. To mitigate such risks, organizations typically focus on robust access controls, continuous monitoring, and comprehensive data encryption strategies to protect information both at rest and in transit.

From the Professional plan

Phishing & Brand Protection

Monitor domains, phishing pages, ads and listings that impersonate your brand, and open takedown requests from the panel.

Related stories