HKR Architects Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 12, 2025, the ransomware group dragonforce listed HKR Architects on its leak site, claiming to have obtained internal files from the firm during a ransomware attack. The number of individuals whose information may be involved remains unknown, and the firm has not issued a public statement confirming the incident or its scope. For clients, employees, and partners of an architecture practice that handles project documentation across multiple countries, the listing raises the possibility that sensitive records have left the organisation’s control.

Breaking down the breach

The only confirmed detail is the group’s listing of HKR Architects on December 12, 2025. The reported summary states that internal files were exfiltrated during a ransomware attack. No figure for the volume of data, the number of people affected, or the precise date of the intrusion has been disclosed. The listing itself constitutes the group’s claim; independent verification of the data’s contents or the attack’s timeline has not been made public.

Who is dragonforce?

Dragonforce is a ransomware operation that maintains a leak site where it publishes the names of organisations it claims to have targeted. The group typically follows a double-extortion pattern: encrypting systems and threatening to release stolen files if a ransom is not paid. Its listings appear without prior public confirmation from the named victims, and the accuracy of the claims varies. Public reporting on the group has documented similar listings against organisations in multiple sectors, though each case requires separate verification.

Who is HKR Architects?

HKR Architects is an international architecture and urban design practice established in 1992. It maintains offices in London, Dublin, Dubai, and Abu Dhabi and works across living, working, hospitality, masterplanning, modular construction, and educational projects. Firms of this type routinely store client briefs, design drawings, planning submissions, correspondence with contractors, and internal administrative records. A breach at such an organisation can therefore touch both commercial project information and personal data belonging to clients and staff.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No further breakdown of file types or data categories has been released. Architecture practices commonly retain project documentation, employee records, and client contact details, yet the exact contents of the claimed exfiltration remain unconfirmed.

The real-world impact

Individuals whose information appears in the exfiltrated files could face risks of targeted phishing or identity misuse if personal details are among the material later published. The organisation itself may encounter delays in project work, increased scrutiny from clients, and costs associated with investigation and remediation. Because the scale of exposure is undisclosed, the practical consequences for any specific person cannot yet be quantified.

Were you affected?

Individuals can take the following steps while more information remains unavailable:

• Monitor official statements from HKR Architects for any notification or guidance.
• Review bank and credit accounts for unusual activity.
• Run a free exposure scan of their email address against known breach datasets.
• Consider enabling multi-factor authentication on accounts that may share email addresses or other details with the firm.

AICompiled with AI assistance from public sources and published under our editorial standards.