Caramel Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 27, 2025, the ransomware group DragonForce listed Caramel on its site and claimed to have carried out an attack that included the exfiltration of internal files. The number of people whose information may be involved is not stated in available reports, and no confirmation of the claim or further details on the incident have been made public. The practical stakes center on the possibility that files containing personal or operational information held by the apparel company could now circulate beyond its control. Individuals connected to Caramel as customers, employees, or partners have no confirmed timeline for notification or remediation.

Breaking down the breach

The only reported detail is the December 27, 2025 listing by DragonForce. No information has been released on the date of any intrusion, the method used, the volume of data taken, or whether files were later published. The organization has not issued a statement confirming or denying the claim, and the number of people affected remains unknown.

Who is dragonforce?

DragonForce is a ransomware group that maintains a public leak site where it lists organizations it claims to have targeted. The group typically operates by encrypting systems and threatening to release stolen files unless a ransom is paid. Its listings are presented by the group itself and are not independently verified in every case.

About Caramel

Caramel was founded in 1999 and is headquartered in London. It manufactures and sells apparel. Companies in this sector routinely maintain records related to product design, supply chains, sales, and customer transactions, as well as employee information required for payroll and operations.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No further description of the file contents has been provided. Organizations of this type commonly store customer contact details, order histories, payment records, employee data, and supplier information, yet the precise categories involved in this incident are unconfirmed.

The real-world impact

If personal details are present in the files, affected individuals could face risks of account takeover, targeted phishing, or identity misuse. For the company, exposure of internal documents could affect supplier relationships, competitive information, or regulatory obligations around data protection. No evidence of subsequent misuse has been reported to date.

Were you affected?

Caramel has not published guidance on how individuals can check their status. Anyone who has purchased from the company or worked there should monitor their financial accounts and email for unusual activity. A free exposure scan of an email address against known breach data can provide an initial indication of whether information has appeared in public listings.

• Review bank and credit-card statements for unrecognized transactions.
• Enable multi-factor authentication on any accounts that may share credentials with Caramel.
• Request a copy of personal data held by the company if you are a customer or former employee.
• Watch official statements from Caramel for any future notifications.

AICompiled with AI assistance from public sources and published under our editorial standards.