Jack Levine Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 6, 2025, the ransomware group dragonforce listed Jack Levine on its leak site. The entry states that internal files were exfiltrated in a ransomware attack. No further details on the number of individuals affected, the volume of data, or the precise timing of the intrusion have been made public. This listing adds to the pattern of ransomware operations that target organizations holding sensitive client records. CPA firms routinely manage financial and tax information, making them recurring points of interest for threat actors seeking data that can be monetized or used for further compromise.

Inside the incident

The only confirmed information is the December 6, 2025 listing and the statement that internal files were removed. The number of people affected remains unknown. No ransom demand amount, encryption details, or confirmation of data publication has been released by either the organization or the group. Public reporting has not disclosed the initial access method or the duration of the attackers’ presence in the network.

Inside dragonforce

Dragonforce is a ransomware operation that maintains a leak site to post names of organizations from which it claims to have obtained data. The group typically advertises exfiltrated files and threatens their release if ransom terms are not met. Its listings are presented by the group itself; independent verification of the data’s authenticity or scope is not provided in the public listing for this case.

Who is Jack Levine?

Jack Levine PA CPAs is a boutique accounting firm located in the Midtown/Wynwood area of Miami. The firm provides corporate tax and accounting services to businesses, individuals, estates, and trusts, with particular focus on clients in real estate, healthcare, e-commerce, and not-for-profit sectors. It has operated for more than 35 years and emphasizes personalized service and the use of technology for client communications.

What was likely exposed

The listing refers only to “internal files.” The exact categories of data have not been disclosed. Organizations of this type commonly hold client tax returns, financial statements, bank details, and correspondence related to estates, trusts, and business filings. Whether any of these specific record types were taken in this incident is unconfirmed.

Why it matters

Client records maintained by CPA firms contain detailed financial histories that can be used for identity-related fraud or targeted financial crime. When such data moves outside the firm’s control, affected individuals may face increased monitoring requirements for tax filings and banking activity. For the firm, the incident adds operational costs associated with investigation, client notification, and potential regulatory review under professional standards that govern tax preparers.

What to do if you're exposed

Individuals who believe their information may have been held by the firm should request a copy of any client notification the firm issues and review their recent tax transcripts and account statements for anomalies. Enabling multi-factor authentication on financial and email accounts reduces the value of any exposed credentials. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.