Ingelan Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to publish claims of attacks on organizations across critical sectors, adding to the steady stream of incidents reported in 2026. On May 17, 2026, the group dragonforce listed Ingelan on its leak site, stating that internal files had been taken during a ransomware operation. The number of individuals affected remains unknown, and no further details on the volume or contents of the material have been made public.

The listing draws attention because Ingelan works with information-system security and industrial automation, areas where exposure of internal materials can extend beyond the company itself. At present the claim stands as an unverified assertion by the group; Ingelan has not issued a public statement confirming or denying the incident.

Inside the incident

The only confirmed public information is the May 17, 2026 listing by dragonforce. The group asserts that a ransomware attack resulted in the exfiltration of internal files. No timeline for the intrusion, no description of the intrusion method, and no figure for the quantity of data have been disclosed. The number of people whose information may be involved is also not known.

Who is dragonforce?

Dragonforce is a ransomware operation that maintains a public leak site where it lists organizations it claims to have compromised. Like other groups using similar infrastructure, it typically combines encryption of systems with the removal of data, then uses the threat of publication to pressure victims. The group has appeared in multiple public listings over recent years, though independent verification of each claim varies and many remain unconfirmed by the targeted organizations.

About Ingelan

Ingelan, founded in 1993 and based in Barcelona, Spain, supplies engineering solutions focused on systems architecture, communications, and the automation of plant systems. Its work also includes information-system security. Organizations in this sector routinely manage technical documentation, network configurations, and client project data that can contain details about critical infrastructure or proprietary processes.

The information in question

The listing refers only to “internal files.” No inventory of specific data types, file categories, or client records has been released. Companies of this kind commonly hold engineering drawings, configuration files, access credentials, and correspondence; however, whether any of these categories are present in the claimed exfiltration cannot be confirmed from available information.

What's at stake

For individuals or client organizations whose details appear in any exfiltrated material, the main concerns are potential misuse of technical credentials or project information. For Ingelan itself, the incident may affect ongoing contracts and require additional resources for investigation and remediation. Because the exact scope remains undisclosed, the practical consequences for any single person or partner cannot yet be quantified.

Were you affected?

Individuals who have worked with Ingelan or similar providers can begin by monitoring official statements from the company. Running a free exposure scan of an email address against known breach data sets offers one way to check whether credentials or other details have appeared in previously published collections. Organizations should review their own vendor-access logs and apply standard credential-rotation practices while awaiting further information.

AICompiled with AI assistance from public sources and published under our editorial standards.