Caprez Ingenieure AG Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional services firms whose work underpins critical infrastructure, using double-extortion tactics that combine encryption with the threat of public data leaks. In this landscape, even listings on criminal leak sites can signal real risk for organisations and the people whose information they hold. Caprez Ingenieure AG, a Swiss engineering company, was named on 1 September 2025 by the group known as dragonforce as a victim of a ransomware attack in which internal files were claimed to have been exfiltrated. Public detail remains limited: the number of people affected is unknown, and no independent confirmation of the full scope has been released. The listing itself is a claim by the attackers, yet it warrants careful attention because engineering firms routinely handle sensitive project, client and operational data whose exposure can have lasting consequences.

What happened

According to the available record, Caprez Ingenieure AG was listed by the dragonforce ransomware group on 1 September 2025. The group claims that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access vector, the exact date of intrusion, the volume of data taken, or whether systems were encrypted—have been publicly disclosed. The number of individuals potentially affected is listed as unknown. There is no public statement from the company confirming or denying the claim at the time of reporting, so the incident rests on the attackers’ leak-site assertion rather than verified forensic disclosure. In short, the known facts establish only that dragonforce publicly named Caprez Ingenieure AG and asserted that internal files had been stolen; everything else remains unconfirmed.

Who is dragonforce?

Dragonforce is a ransomware operation that has been active in recent years and is known for double-extortion tactics. Like many contemporary groups, it typically encrypts victims’ systems while simultaneously copying data and threatening to publish it on a dedicated leak site if a ransom is not paid. The group has been observed operating under a ransomware-as-a-service model, in which affiliates carry out attacks and share proceeds with the core developers. Public reporting has linked dragonforce to campaigns against organisations across multiple sectors and regions; the group often posts victim names, sample files and countdown timers to pressure payment. In this case, the listing of Caprez Ingenieure AG constitutes a claim by dragonforce that it successfully breached the firm and exfiltrated internal files. No independent verification of that claim has been supplied in the public record, and readers should treat the group’s assertions with appropriate caution.

Who is Caprez Ingenieure AG?

Caprez Ingenieure AG is an engineering firm that provides structural, civil, bridge, water-supply, sewage, snow-making, building-maintenance and special-fields engineering services. Companies of this type design and oversee infrastructure that communities rely on daily—bridges, water systems, buildings and specialised facilities. They typically maintain detailed project documentation, client contracts, technical drawings, correspondence with public authorities, and internal operational records. Because their work often involves public infrastructure and private clients alike, a compromise of their systems can affect not only the firm itself but also the partners, municipalities and individuals connected to those projects. The precise location and scale of Caprez Ingenieure AG’s operations are not expanded upon in the breach record, yet the nature of its stated services places it squarely in a sector that holds both commercially sensitive and potentially personally identifiable information.

What data was at risk

The only data type named in the public facts is “internal files” said to have been exfiltrated in a ransomware attack. No inventory of specific file categories, no count of records, and no confirmation of personal data elements have been released. Organisations that perform structural and civil engineering work commonly store project plans, engineering calculations, client contact details, contracts, invoices, employee records, and correspondence with suppliers or regulators. Whether any of those categories were among the files claimed by dragonforce is unconfirmed. Because the facts state only that internal files were exfiltrated, any assertion about particular data types beyond that description would be speculation. The exact contents therefore remain unconfirmed, and affected parties cannot yet know with certainty what, if anything, of theirs was involved.

Why it matters

Even when the full scope is unknown, a claimed ransomware incident at an engineering firm carries concrete risks. If internal files were indeed taken, they could include proprietary designs that competitors or malicious actors might misuse, or personal information of employees and clients that could enable phishing, identity fraud or further social-engineering attacks. For the organisation, the consequences may include operational disruption, reputational damage, regulatory scrutiny under data-protection rules, and the cost of investigation and remediation. For individuals whose data might appear in those files, the practical harms range from unwanted contact and credential-stuffing attempts to longer-term privacy erosion. Because the number of people affected is unknown and the precise data types are undisclosed, the prudent stance is to treat the possibility of exposure seriously without assuming the worst. The listing itself also signals that attackers continue to view mid-sized professional-services firms as viable targets, reinforcing the need for robust defences across the sector.

If your data was in this claimed breach

If you have a past or present relationship with Caprez Ingenieure AG—as an employee, client, contractor or partner—consider taking a few measured steps. Monitor financial and email accounts for unusual activity, enable multi-factor authentication wherever available, and be alert to phishing messages that reference engineering projects or company names. Change passwords that may have been reused across services. Because the exact data involved has not been confirmed, these precautions are precautionary rather than reactive to a verified personal exposure. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets; such a check does not prove involvement in this specific incident but can surface earlier compromises that warrant attention. Stay informed through official company or regulatory channels rather than relying solely on criminal leak-site claims, and report any confirmed misuse of personal information to the appropriate authorities.

AICompiled with AI assistance from public sources and published under our editorial standards.