Ifage Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

A ransomware group known as DragonForce has listed the Geneva-based adult education foundation Ifage on its leak site, claiming to have carried out an attack that resulted in the exfiltration of internal files. The listing was reported on July 14, 2026. The number of individuals whose information may be involved remains unknown, and the foundation has not publicly confirmed the incident or provided details on the scope of any data access.

Inside the incident

The only confirmed public information is the appearance of Ifage on the DragonForce leak site and the group's assertion that internal files were taken during a ransomware operation. No figures have been released on the volume of data, the number of records, or the timeline of the intrusion. It is not known whether encryption was also deployed against Ifage systems or whether any data has been published beyond the initial listing.

Inside dragonforce

DragonForce is a ransomware operation that, like other groups in this category, typically gains access to target networks, exfiltrates data, and then lists victims on a dedicated site to pressure them into payment. Such groups have previously targeted organisations across multiple sectors and have used similar leak-site postings to publicise claims of compromise. Any specific assertions made by the group about Ifage remain unverified claims at this stage.

Who is Ifage?

Ifage is a foundation based in Geneva that provides continuing education and professional development for adults. It delivers courses in languages, management, administration, industry, construction, and new technologies, and issues recognised certifications including federal diplomas and international certificates. Its clients include both individual professionals seeking career advancement and companies arranging training for employees. Organisations of this type routinely collect and store personal details, employment information, and records related to course participation and certification.

What was likely exposed

The listing refers to internal files exfiltrated during the attack. The precise contents of those files have not been disclosed. Educational and training organisations commonly hold names, contact details, employment records, course histories, and certification data, but it is not confirmed whether any of these categories are present in the material allegedly taken from Ifage.

What's at stake

Individuals whose records appear in training or certification files could face risks of identity misuse or unwanted contact if the material is later published or sold. For the organisation, the incident may affect relationships with clients who expect confidentiality around professional development records. The absence of Reported Details on scale or content means the practical impact cannot yet be quantified.

What to do if you're exposed

Anyone who has taken courses or held certifications through Ifage should monitor their email and financial accounts for unusual activity. Changing passwords for any associated accounts and enabling multi-factor authentication where available are standard first steps. Readers can also run a free exposure scan of their email address to check whether their information has appeared in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.