The Smile Spa listed on dragonforce leak site

• Ransomware group: dragonforce
• Country: Canada
• Sector: Retail & E-Commerce
• Announcement date: August 27, 2025

The Smile Spa targeted by dragonforce ransomware group

The Smile Spa has been listed on the leak site of the ransomware group known as dragonforce. According to the announcement made by the group, a significant amount of data belonging to the organization has been obtained by the attackers.

Details of the claimed attack

The dragonforce group listed The Smile Spa on its leak site on August 27, 2025. The group claims to have gained access to the organization's digital assets and indicates that a dataset is being held. This announcement was made public through the group's own platform, marking a formal claim of a successful breach against the entity.

Ransomware groups often utilize leak sites to exert pressure on their victims. This tactic is a core component of double extortion, where attackers not only encrypt an organization's data to disrupt operations but also threaten to publish sensitive information if a ransom is not paid. By hosting these listings on their own platforms, ransomware groups attempt to damage the reputation of the victim and force compliance through the threat of public exposure.

Data involved in the incident

Regarding the specifics of the stolen information, there is no detailed list regarding the content of the leaked data. However, the screenshot provided by the group indicates a total data size of 65.41 GB. The listing does not provide a specific file count or a breakdown of the individual files contained within the dataset.

About The Smile Spa

The Smile Spa is a healthcare center located in Baton Rouge, Louisiana, operated by Dr. Aimee Russo-Mounger. The facility offers dental services and various spa treatments to its clients.

Potential impact and industry considerations

This incident may bring the risk of exposure for patient or employee data held by The Smile Spa. Given that the organization provides dental and spa services, the leaked data could potentially contain sensitive personal health information, which may lead to legal consequences under regulations such as HIPAA. The publication of this data might increase the likelihood of affected individuals being targeted by identity theft or phishing attacks.

Public information about the dragonforce group is limited; however, it is reported that the group adopts a model of providing branding and infrastructure to affiliates. This model allows various actors to conduct attacks using the group's established identity and technical resources. When an organization faces such a breach, it may need to notify affected parties and review necessary security measures.

In the healthcare and wellness sector, protecting sensitive information is critical due to the high value of medical records on the dark web. Organizations in this sector typically focus on implementing robust access controls, encryption for data at rest and in transit, and continuous monitoring to detect unauthorized access. Following a potential breach, common defensive and reactive steps include conducting a thorough forensic investigation to determine the scope of the intrusion, strengthening network segmentation, and enhancing employee training to prevent initial access through phishing.

• No specific data types were listed in the announcement.