Váhostav listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: Slovakia
• Sector: Manufacturing
• Announcement date: December 21, 2025

Váhostav targeted by dragonforce ransomware group

The Slovakian-based construction company Váhostav has been listed on the leak site of the ransomware group known as dragonforce. According to the announcement made by the threat actors, a significant amount of data has been compromised during a recent cyberattack.

Details of the claimed attack

The threat actor known as dragonforce has announced a ransomware incident by listing data belonging to Váhostav on its leak site. The group is described as an entity that emerged in 2023 and operates by providing infrastructure to affiliates. This affiliate model is a common tactic in modern ransomware operations, where a central group provides the necessary tools and infrastructure to various individuals or smaller groups to carry out attacks. The announcement was published on December 21, 2025, and the group claims that 224.87 GB of data has been compromised from the organization's systems.

Data involved in the incident

The exact nature of the leaked data has not been specified by the attackers. However, given that the company conducts construction and engineering projects, it is assessed that commercial and technical documents may be at risk. The listing does not specify the exact file count or the specific types of files that were exfiltrated. The following details regarding the claimed data were provided:

• Claimed data size: 224.87 GB

About Váhostav

Váhostav is a leading construction company based in Slovakia. It specializes in complex and technically demanding projects across various sectors, including transportation, engineering, and industrial construction.

Potential impact and industry risks

This claim against Váhostav could negatively impact the organization's operational continuity and commercial reputation. As a company operating in Slovakia, it is likely that the organization could face legal sanctions under GDPR if the leaked data contains personal information. The disclosure of sensitive information can lead to significant regulatory scrutiny and financial consequences.

Due to the sensitivity of projects in the construction sector, the disclosure of technical drawings and contracts may lead to secondary risks and a loss of competitive advantage. When technical specifications and proprietary project details are exposed, it can undermine the firm's position in highly competitive bidding environments. Furthermore, the affiliate model of the dragonforce group may increase the variety and frequency of attacks, suggesting that organizations should exercise greater caution in protecting their digital assets.

Additionally, the theft of data presents a risk of follow-on attacks. Targeted phishing attacks conducted using the leaked data could pose an additional threat to employees and business partners. In such scenarios, attackers often use stolen information to craft highly convincing messages to gain further access to networks or to conduct financial fraud. To mitigate these risks, organizations typically focus on robust data encryption, strict access controls, and comprehensive employee training to recognize social engineering attempts.