HESCO Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
HESCO was listed by the dragonforce ransomware group on December 08, 2025, with an undisclosed number of people potentially affected after internal files were exfiltrated. Individuals connected to the organisation should check any notices from HESCO and consider changing passwords or enabling additional account protections if their information may be involved.
What happened
On December 08, 2025, HESCO was listed by the dragonforce ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. No confirmed count of affected people or additional details on the method or timing of the incident have been made public.
Who is dragonforce?
Dragonforce is a ransomware group known for encrypting systems, exfiltrating data, and posting victim names on a leak site when ransom demands are not met. The group’s listings function as public claims of responsibility rather than independently verified incidents. Similar actors in this category have previously targeted organisations across multiple sectors and released portions of stolen data after initial announcements.
About HESCO
HESCO Foodservice Ltd. operates from locations in Edmonton and Calgary, supplying products, cleaning supplies, commercial equipment, and kitchen design services to the foodservice industry. The company has conducted business for over 95 years. Organisations of this type routinely maintain records on commercial clients, suppliers, employees, and operational systems.
What data was at risk
The only detail released is that internal files were allegedly exfiltrated. The exact categories of information contained in those files have not been disclosed. Companies in the foodservice supply sector commonly hold business correspondence, order records, employee information, and vendor details, but whether any of these specific types were involved in this case remains unconfirmed.
What's at stake
Exposed internal files can lead to follow-on risks such as targeted fraud against business partners or misuse of any personal details that may have been stored alongside operational records. For the organisation, the incident adds costs related to investigation, potential regulatory reporting, and restoration of systems. Individuals have limited visibility into the scope until further information is released or confirmed.
What to do if you're exposed
Anyone who has done business with HESCO or worked there should treat the situation as a standard data-exposure precaution. Begin by monitoring bank and credit accounts for unusual activity and enabling multi-factor authentication on any linked services. Request a copy of your data from the company if you believe records about you were held there.
- Change passwords for any accounts that may share credentials with HESCO systems.
- Watch for unsolicited contact that references the company or recent transactions.
- Run a free exposure scan of your email address against known breach data to check for additional appearances.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Burnex Listed by dragonforce Ransomware GroupBarnes & Jones Listed by dragonforce Ransomware GroupMullinax Ford Listed by dragonforce Ransomware GroupTri-State Metal Roofing Supply Listed by dragonforce Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the HESCO Listed by dragonforce Ransomware Group →
Publicly posted by dragonforce — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.