Tri-State Metal Roofing Supply targeted by Dragonforce ransomware group

• Ransomware group: Dragonforce
• Country: United States
• Sector: Manufacturing
• Announcement date: December 24, 2025

Dragonforce claims data breach against Tri-State Metal Roofing Supply

The threat actor known as Dragonforce has listed Tri-State Metal Roofing Supply on its leak portal, alleging a significant data breach. According to the announcement posted on December 24, 2025, the group claims to have obtained a dataset totaling 34.73 GB from the company's systems. This development follows a pattern of double extortion tactics often employed by modern ransomware groups, where stolen data is used as leverage to pressure organizations into paying ransoms.

Ransomware leak sites serve as a public stage for cybercriminals to exert pressure on their victims. In these scenarios, attackers typically attempt to encrypt an organization's critical systems to halt operations while simultaneously exfiltrating sensitive data. The threat of releasing this information publicly is used to increase the pressure on the victim, creating a dual-threat environment where the organization faces both operational downtime and potential reputational or legal damage from the exposure of private information.

Details of the claimed incident

The announcement made by Dragonforce on December 24, 2025, includes descriptive information regarding the business operations of Tri-State Metal Roofing Supply. While the group has published a listing on its leak portal, the specific nature and contents of the leaked data remain unclear. The available information provided by the threat actor is limited to the scale of the breach rather than the specific categories of information stolen.

Regarding the specifics of the stolen information, the listing names no specific data types; the provided screenshot only displays the total data volume of 34.73 GB.

In many such incidents, organizations face the challenge of determining exactly what was taken. When a breach occurs, it is common for attackers to target databases containing employee records, customer information, or proprietary business documents. However, in this specific case, the group has not provided a detailed inventory of the files or the types of data contained within the 34.73 GB volume.

About Tri-State Metal Roofing Supply

Tri-State Metal Roofing Supply is a Utah-based supplier of metal roofing and siding materials. Offering American-made products at factory-direct pricing, the company serves clients through its locations in Riverdale, Payson, and St. George.

Impact and industry considerations

Dragonforce is a ransomware group that emerged in 2023 and is reported to operate by providing infrastructure and branding to affiliates. This model allows various attackers to use the group's established reputation and technical tools to conduct their own campaigns. Such leaks may lead to the exposure of sensitive information belonging to the company's employees or customers, potentially creating risks for identity theft or targeted phishing attacks.

Because the company is based in the United States, state-level data protection laws and notification requirements may be applicable following such an incident. The exposure of data can lead to complex regulatory obligations depending on the jurisdiction and the nature of the information involved. Furthermore, the incident could potentially impact the company's operational continuity and may pose secondary risks to its supply chain partners.

For organizations operating within the manufacturing and supply sectors, maintaining robust cybersecurity postures is essential. Common defensive steps often include implementing multi-factor authentication, maintaining offline backups of critical data, and conducting regular security awareness training for employees to prevent initial access via phishing. Additionally, monitoring for unauthorized data exfiltration and maintaining a clear incident response plan are vital components for mitigating the impact of a potential ransomware event.