Express Logistics and Distribution Ltd Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Express Logistics and Distribution Ltd, a major Bulgarian logistics firm, was listed on 11 October 2025 by the ransomware group dragonforce. The group claims to have exfiltrated a large volume of internal files in a ransomware attack and says it expects the company to make contact to prevent publication of private data spanning many years. The number of people affected remains unknown, and independent confirmation of the intrusion or the precise contents of any stolen material has not been made public.

For customers, partners and employees of a company that moves goods across Bulgaria and the wider region, any confirmed exposure of internal files carries practical consequences. Until the organisation itself provides further detail, the listing stands as an unverified claim that warrants careful attention rather than alarm.

What happened

On 11 October 2025 the ransomware group dragonforce publicly listed Express Logistics and Distribution Ltd on its leak site. According to the group’s own statement, internal files were exfiltrated during a ransomware attack and a large volume of private data accumulated over many years is at risk of publication unless the company contacts them. No technical details of the intrusion method, the exact date of the attack, the volume of data taken, or any ransom demand have been disclosed in the available record. The number of individuals whose information may be involved is listed as unknown. Public reporting so far consists solely of the group’s claim; the company has not issued a public confirmation or denial that has entered the record used here.

Who is dragonforce?

Dragonforce is a ransomware operation that has been active in recent years and follows the now-common double-extortion model. After gaining access to a network, the group typically encrypts systems while also copying data, then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. Listings on that site are claims made by the group itself; they do not automatically prove that every file described was successfully taken or that the victim organisation has verified the breach. Dragonforce has previously targeted organisations across multiple sectors and geographies, often highlighting the size or regional importance of the victim in its posts. Like other ransomware crews, it relies on public pressure created by the threat of data release. Nothing in the present record establishes that dragonforce’s specific assertions about Express Logistics and Distribution Ltd have been independently verified.

Who is Express Logistics and Distribution Ltd?

Express Logistics and Distribution Ltd is a Bulgarian distribution and logistics company. Public descriptions associated with the listing state that it employs approximately 900 people, operates a fleet of 380 vehicles, and maintains the largest direct market coverage in Bulgaria. It is described as one of the ten largest companies in the country and has been ranked fifth among the most dynamic firms in Southeast Europe according to a “SEE TOP 100” study. Organisations of this type manage the movement of goods for commercial clients, maintain warehouse and transport records, handle invoices, contracts, employee data and customer contact details, and often hold multi-year archives of operational documents. A breach at such a firm can therefore affect not only its own staff but also the many businesses that rely on it for supply-chain services. The consequential nature of any confirmed incident stems from the company’s scale and its central role in regional logistics rather than from any proven negligence.

The information in question

The only data category named in the available facts is “internal files exfiltrated in ransomware attack.” No further breakdown—such as whether the material includes customer lists, employee records, financial documents, contracts or operational logs—has been disclosed. The group claims the volume is large and covers many years, yet the exact contents remain unconfirmed. Logistics companies typically hold shipment records, client contact information, employee personal data, invoices, vehicle and warehouse inventories, and partnership agreements. Any of these could be present in an internal-file archive, but that possibility is general knowledge about the sector, not a verified inventory of what dragonforce may hold. Until the company or a competent authority publishes a confirmed list, the precise nature of the exposed material must be treated as unknown.

The real-world impact

If internal files were indeed taken, affected individuals could face risks that include targeted phishing that references real logistics transactions, identity-related fraud if personal details appear, or competitive harm if commercial contracts and pricing data become public. Employees might see payroll or personnel information misused. The organisation itself could confront operational disruption, regulatory notification duties under European data-protection rules, and reputational pressure from clients who depend on reliable, confidential handling of their goods. Because the number of people affected is unknown and the data types are not itemised, the scale of these risks cannot yet be quantified. The primary immediate effect is uncertainty: people connected to the company have no confirmed list of what, if anything, has left its systems.

If your data was in this claimed breach

Monitor bank and credit statements for unexpected activity and treat unsolicited messages that mention Express Logistics or recent shipments with caution. Change passwords on any accounts that may have shared credentials with work systems, and enable multi-factor authentication where available. If you are an employee or contractor, follow any guidance the company issues once it confirms the facts. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets; such a scan will not confirm involvement in this specific incident but can highlight earlier exposures that warrant attention. Keep records of any suspicious contact and report confirmed fraud to the relevant national authorities.

AICompiled with AI assistance from public sources and published under our editorial standards.