Thaon-les-Vosges listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: France
• Sector: Government & Defense
• Announcement date: March 29, 2025

Thaon-les-Vosges targeted by dragonforce ransomware group

The municipality of Thaon-les-Vosges, a public institution in France, has been listed on the leak site of the dragonforce ransomware group. According to an announcement published by the threat actors, the organization has been victimized in a cyberattack involving data exfiltration.

Details of the alleged attack

The dragonforce group published an announcement on March 29, 2025, claiming to have compromised data belonging to the Thaon-les-Vosges municipality. The post alleges that the group obtained access to the institution's network as early as March 11, 2025. This suggests that the attackers may have maintained presence within the municipal network for several weeks prior to the public announcement on their leak site.

Ransomware leak sites are commonly used by cybercriminal groups to pressure victims into paying ransoms. In many modern ransomware campaigns, threat actors employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption process begins. By threatening to release this stolen data on a public platform, the attackers aim to increase the pressure on the victim to comply with ransom demands, leveraging the threat of reputational damage or regulatory scrutiny.

Data involved in the claim

The group claims that a total of 9.15 GB of data belonging to the municipality has been exfiltrated. Regarding the specific nature of the files, the provided information does not contain specific details regarding the nature of the leaked data; it only states that a 9.15 GB dataset has been published. The listing names no specific data types.

About Thaon-les-Vosges

Thaon-les-Vosges is a municipality located in the Vosges department in the Grand Est region of France. It serves as a public institution providing local government services to the residents of the region.

Risk assessment and implications

This alleged leak may pose a risk of exposure for citizen data and administrative records held by the municipality. As the institution is based in France, the incident may entail legal consequences regarding data protection obligations under the GDPR. Such attacks against public institutions may create secondary risks, such as exposing citizens to identity theft or targeted phishing campaigns.

The dragonforce group, which emerged in 2023, is reported to utilize a model providing infrastructure to affiliates. Consequently, the possibility that the attack was carried out by different actors should be considered. In such models, the core group provides the technical framework, while various affiliates carry out the actual intrusions, making attribution and defensive response more complex.

For organizations in the government and defense sector, maintaining robust security postures is critical. Common defensive steps often include implementing multi-factor authentication, maintaining offline backups, and conducting regular network segmentation to prevent lateral movement. Furthermore, organizations must remain vigilant against phishing, which is a frequent entry point for ransomware actors. Given the potential for secondary risks like identity theft, public institutions must prioritize the protection of citizen records to mitigate long-term impact.