Encompass Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 3, 2026, the ransomware group dragonforce listed Encompass on its leak site and claimed to have exfiltrated internal files during a ransomware attack. The number of people affected has not been disclosed. This listing occurs against a backdrop of sustained ransomware activity in which groups target organizations that hold operational and client data, often publishing claims on dedicated leak sites when negotiations stall.

What happened

Encompass was added to dragonforce’s leak site on the reported date of March 3, 2026. The group claims internal files were taken during a ransomware intrusion. No confirmed count of affected individuals or additional technical details about the intrusion have been made public.

Inside dragonforce

Dragonforce is a ransomware operation that follows the common pattern of encrypting systems and exfiltrating data before listing victims on a public site. The group’s listings serve as a pressure tactic, asserting that stolen material will be released unless demands are met. Public reporting on the actor has documented similar claims against other organizations in recent years, though each listing remains an unverified assertion by the group until independently confirmed.

About Encompass

Encompass Solutions, founded in 2001 and based in Clarksville, Virginia, operates as a preferred Epicor partner and value-added reseller. It supplies ERP software, custom development, and managed services primarily to manufacturing businesses. Organizations in this sector routinely handle production schedules, supplier records, financial information, and client configurations, making them repositories of data that can affect both the company and its customers if exposed.

The information in question

The only detail released states that internal files were exfiltrated. No inventory of specific file types, record counts, or data categories has been confirmed. Organizations of this type commonly store operational records, customer implementation details, and internal communications, yet the precise contents tied to this incident remain unverified.

What's at stake

Exposure of internal files can create operational disruption for Encompass and the manufacturers it serves, including potential misuse of process information or credentials. For individuals whose records appear in those files, downstream risks include targeted phishing or account compromise. The organization faces possible regulatory scrutiny and remediation costs typical of ransomware events.

What to do if you're exposed

Individuals who believe their information may be involved should begin with basic account hygiene and monitoring. Organizations advise the following immediate steps:

• Change passwords for any accounts linked to Encompass services and enable multi-factor authentication where available.
• Review bank and credit statements for unusual activity and place fraud alerts with major credit bureaus if personal identifiers are suspected to be present.
• Run a free exposure scan of your email address against known breach data to determine whether your information appears in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.