Cotswold Fayre Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized suppliers and distributors across the UK food and specialty goods sector, using data theft and public leak-site listings to pressure victims. In this environment, even organisations without a high public profile can find themselves named on criminal forums, with the mere claim of a breach creating uncertainty for customers, suppliers and staff.

On 5 March 2025, Cotswold Fayre was listed by the ransomware group known as dragonforce. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical detail has not been disclosed. The listing itself is a claim by the group; independent confirmation of the full scope is not publicly available.

Inside the incident

According to the available record, Cotswold Fayre appeared on a dragonforce leak site on or around 5 March 2025. The report characterises the event as a ransomware attack in which internal files were taken. No public figure has been given for the volume of data, the precise date of initial access, the encryption status of systems, or any ransom demand. The number of individuals whose information may have been involved is listed as unknown. Method of entry, dwell time and any subsequent recovery steps remain undisclosed in the material provided.

Because the primary public signal is the group’s own listing, the incident should be treated as an unverified claim of compromise and data theft until the organisation or independent investigators publish further detail. What is stated is limited to the fact of the listing and the assertion that internal files were exfiltrated.

The group behind it: dragonforce

Dragonforce is a ransomware operation that has appeared in public threat reporting as a group that steals data before or during encryption and then advertises victims on dedicated leak sites. Like other actors in this category, it typically seeks to monetise both the disruption of operations and the threat of publishing stolen material. Public accounts of its activity describe the use of double-extortion tactics: locking systems while also threatening to release or sell exfiltrated files if payment is not made.

The group’s listing of Cotswold Fayre is presented as a claim that the organisation was successfully attacked and that internal files were removed. No additional statements attributed specifically to dragonforce about this victim—such as sample file counts, screenshots, or deadlines—are contained in the facts available for this article. Readers should therefore treat the listing as an assertion by the threat actor rather than as independently verified fact.

About Cotswold Fayre

Cotswold Fayre is a UK-based wholesale distributor of specialty food and related products. Public background supplied with the breach record states that the business was started by Paul Hargreaves in the early 1990s, originally as the wholesale distribution arm of a number of small Cotswold-based companies. It has grown with rising demand for high-quality products not widely stocked by large multiples. The company now supplies more than 700 customers and works with over 80 suppliers, most of them specialty producers in the UK, with some located as far afield as New Zealand and South Africa.

Organisations of this type sit at the centre of supply chains. They typically hold commercial contracts, order histories, pricing information, supplier and customer contact details, and internal operational records. A ransomware incident that involves the exfiltration of internal files therefore carries consequences beyond the immediate technical disruption: it can affect trading partners, staff and the confidentiality of commercial relationships.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No inventory of specific data categories—such as names, addresses, financial details, or authentication credentials—has been published in the available record. Exact contents therefore remain unconfirmed.

In general, a wholesale specialty-food distributor of Cotswold Fayre’s size and role would be expected to hold customer and supplier contact information, order and invoice records, product specifications, internal correspondence, and possibly limited employee data. Whether any of those categories were among the files taken cannot be stated as fact on the basis of the current public information. The absence of a detailed disclosure means affected parties cannot yet know with certainty what, if anything, relating to them was involved.

The real-world impact

For individuals whose details may have been present in internal files, the practical risks include unwanted contact, phishing attempts that reference genuine commercial relationships, or the misuse of any personal or financial information that happened to be stored. Because the scale and content remain unknown, the precise level of exposure for any given person cannot be quantified.

For the organisation itself, a claimed ransomware incident typically brings operational interruption, the cost of investigation and recovery, potential contractual notifications to customers and suppliers, and reputational questions. Trading partners may seek reassurance about the security of shared data. Until more detail is released, both the company and those connected to it must operate with incomplete information about what was taken and how far it has spread.

Were you affected?

If you are a customer, supplier or employee of Cotswold Fayre, treat the situation with measured caution rather than alarm. Concrete steps that are useful regardless of the still-unknown scope include:

• Monitor bank and card statements for unexpected activity and enable transaction alerts where available.
• Be sceptical of unsolicited emails, calls or messages that reference Cotswold Fayre, recent orders or supplier relationships; verify any request for payment or data through a known, independent channel.
• Change passwords on accounts that may have been used in dealings with the company, especially if the same password was reused elsewhere, and turn on multi-factor authentication.
• Watch for phishing that uses accurate commercial details as bait; do not open attachments or follow links from unexpected messages.
• If you receive formal notification from Cotswold Fayre, follow the guidance it provides and keep a record of any correspondence.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets. Such a scan does not confirm or rule out involvement in this specific incident, but it can surface earlier exposures that warrant attention. Public detail on the Cotswold Fayre event remains limited; further clarity will depend on any additional statements from the organisation or independent reporting.

AICompiled with AI assistance from public sources and published under our editorial standards.