bunch.ca Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 2, 2026, the ransomware group dragonforce listed bunch.ca on its site and stated that internal files had been taken from the company. The number of people whose information may be involved is not known, and no further details about the timing or method of the incident have been made public. The practical stakes center on the possibility that operational records from a construction contractor active in Western Canada’s oil and gas sector have left the organization’s control. Even without confirmed personal data, such files can contain information that affects employees, subcontractors, and project partners.

Inside the incident

The only confirmed public information is the April 2, 2026 listing by dragonforce and the group’s assertion that internal files were exfiltrated during a ransomware attack. No figure for records or individuals has been released, and the date of the underlying intrusion itself remains undisclosed. No confirmation from bunch.ca or independent verification of the claimed data has been reported.

Who is dragonforce?

Dragonforce is a ransomware group that has conducted operations against organizations in multiple countries. Like other groups of its kind, it typically gains access through common intrusion methods, deploys encryption on victim systems, and then lists selected targets on a public site while threatening to release stolen material. Its listings function as claims of responsibility rather than independently verified events.

About bunch.ca

Bunch.ca operates as a contractor specializing in the construction of facilities for the oil and gas industry in Western Canada. Organizations in this sector routinely manage project documentation, engineering specifications, vendor records, and personnel information tied to large-scale industrial work. A breach at such a firm can therefore touch both corporate operations and the data of individuals connected to those projects.

What was likely exposed

The listing states that internal files were exfiltrated. The precise categories of data contained in those files have not been disclosed. Companies of this type commonly hold employee contact details, contract records, safety documentation, and technical drawings; however, whether any of these specific items were taken in this case is unconfirmed.

Why it matters

Exposure of internal files from an industrial contractor can create downstream risks for the organization and for individuals whose details appear in project or employment records. Potential consequences include targeted follow-on attempts at those individuals or secondary misuse of operational information. The absence of a confirmed count of affected people leaves the full scope of personal exposure unclear.

If your data was in this claimed breach

Begin by monitoring accounts associated with any email addresses or identifiers you have shared with bunch.ca or its partners. Enable multi-factor authentication on those accounts and review recent login activity. Individuals can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.