coBuilder Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target specialised software providers that sit at the centre of complex supply chains, using data theft and public leak-site postings as leverage. In this environment, even listings that remain unverified can create lasting uncertainty for customers and partners who rely on the affected organisation’s systems.

On 17 June 2025, the ransomware group known as dragonforce publicly listed coBuilder on its leak site, claiming to have exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and independent confirmation of the full scope has not been published. The listing itself is a claim by the group; public detail is limited to what dragonforce has asserted and to coBuilder’s known business profile.

Inside the incident

According to the reported information, dragonforce listed coBuilder on 17 June 2025 and stated that internal files had been exfiltrated during a ransomware attack. The listing refers to complete databases among the material claimed to have been taken. No further technical details—such as the initial access method, the precise date of intrusion, the volume of data, or any ransom demand—have been disclosed in the available record. The number of individuals potentially affected is unknown. At present the incident is known only through the group’s claim on its leak site; no independent verification of the data’s authenticity or completeness has been made public.

Who is dragonforce?

Dragonforce is a ransomware operation that has been observed conducting double-extortion campaigns: encrypting systems while simultaneously stealing data and threatening to publish it if payment is not made. The group typically posts victim names and sample files on a dedicated leak site to apply pressure. Its public activity has included listings across multiple sectors, often accompanied by claims of large data volumes. In the case of coBuilder, the only specific assertion available is the group’s own listing that internal files, including complete databases, were exfiltrated. No additional statements attributed to dragonforce about this particular victim have been reported beyond that claim.

Who is coBuilder?

coBuilder is a technology company that supplies digital solutions to the construction industry. Its products focus on asset data management, digital product passports, sustainability reporting, and integration with building-information-modelling (BIM) software through APIs. The company also offers consultancy services aimed at helping construction stakeholders improve collaboration, digitalisation and efficiency across the value chain. Organisations of this type routinely hold project data, supplier and partner information, technical documentation and, in many cases, personal data belonging to employees, clients or contractors. A breach at such a provider can therefore affect not only the company itself but also the wider construction ecosystem that depends on its platforms for information flow and compliance reporting.

The information in question

The available facts state that internal files were exfiltrated and that the material includes complete databases. Beyond that description, the exact data types, file names or categories have not been disclosed. Companies operating in the construction-technology sector typically maintain databases containing project records, technical specifications, supplier details, user accounts and sustainability or compliance data. Whether any of those categories were among the files claimed by dragonforce remains unconfirmed. Public detail is limited to the group’s assertion that internal files and complete databases were taken; no inventory of the contents has been independently verified or released.

The real-world impact

For individuals whose information may have been present in coBuilder’s systems, the primary risks include potential misuse of personal or professional contact details, exposure of project-related correspondence, and the possibility that credentials or identifiers could be reused in further phishing or social-engineering attempts. Because the precise contents remain unconfirmed, the concrete exposure for any given person cannot yet be quantified. For coBuilder itself, the listing creates reputational pressure, possible contractual obligations to notify partners, and the operational cost of investigating and containing the incident. Construction-sector clients that rely on coBuilder’s platforms for data exchange may also face temporary uncertainty about the integrity of shared project information until the full scope is clarified.

What to do if you're exposed

If you have used coBuilder services or believe your details may have been stored in its systems, the following practical steps are advisable:

• Monitor financial and email accounts for unexpected activity and enable multi-factor authentication where available.
• Change passwords associated with any coBuilder-related accounts and avoid reusing those passwords elsewhere.
• Treat unsolicited messages that reference construction projects or coBuilder as potential phishing attempts until verified through official channels.
• Request confirmation from coBuilder or relevant partners about whether your data was involved once official notifications are issued.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach datasets.

These measures reduce immediate risk while further details about the incident remain limited. Official updates from coBuilder, when published, should be treated as the primary source of confirmed information.

AICompiled with AI assistance from public sources and published under our editorial standards.