Heartland Growers Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Heartland Growers was listed by the dragonforce ransomware group on May 24, 2026, after internal files were exfiltrated in a ransomware attack. An undisclosed number of people may have been affected; anyone connected to the organisation should verify their status and review their accounts for signs of misuse.
Inside the incident
Public information about the event is limited to the group’s listing. No confirmation has been issued by Heartland Growers regarding the timing of any intrusion, the volume of data taken, or the methods used to gain access. The scale of the operation and whether any data was subsequently published are also not reported in available records.
Who is dragonforce?
Dragonforce is a ransomware group that has conducted operations against organizations in multiple sectors. Like other groups of its type, it typically employs encryption alongside the threat of data release to pressure victims. The listing of Heartland Growers constitutes the group’s claim of involvement; independent verification of the claim has not been made public.
About Heartland Growers
Heartland Growers operates as a wholesale greenhouse in Westfield, Indiana. The business has been owned and run by the Gapinski family since 1984 and supplies plants to garden centers, florists, landscapers, and retail chains across the Midwest. Its facility spans more than 30 acres and focuses on products such as bedding plants, geraniums, lilies, and hanging baskets.
What was likely exposed
The listing identifies only “internal files” as having been removed. No further inventory of data categories has been released. Organizations in this sector commonly maintain records that include customer contact details, order histories, supplier agreements, and operational documents; however, whether any of these specific categories were present in the exfiltrated material is unconfirmed.
Why it matters
Even without a confirmed count of affected individuals, the removal of internal files can create downstream consequences for a business that handles commercial accounts and supply-chain information. Customers and partners may face indirect exposure if their details appear in the files, while the organization itself must address potential operational disruption and the costs of response.
Were you affected?
Individuals who have conducted business with Heartland Growers can take the following initial steps:
- Monitor statements from the company for any official notification.
- Review account activity for signs of unauthorized use.
- Run a free exposure scan of their email address against known breach data sets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Champion Homes Listed by thegentlemen Ransomware GroupInnovision Holdings Listed by thegentlemen Ransomware Groupvegfresh.com Listed by dragonforce Ransomware GroupDouble C Farm Listed by thegentlemen Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Heartland Growers Listed by dragonforce Ransomware Group →
Publicly posted by dragonforce — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.