Lift Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 13, 2026, the ransomware group dragonforce listed Lift AG on its leak site, stating that internal files had been taken during a ransomware attack. The number of people affected is not known, and no further details about the scale or method of the incident have been made public.

The listing raises the possibility that data held by the Swiss elevator manufacturer could appear on the open internet. Lift AG maintains customer contracts, service records and operational information for residential and commercial buildings, so any confirmed exposure would affect individuals and organisations that rely on its equipment and maintenance services.

Breaking down the breach

The only confirmed information is the April 13 listing itself. Dragonforce claims to have exfiltrated internal files, but the company has not issued a public statement confirming or denying the incident. No figure for the volume of data, the number of records, or the date of the alleged intrusion has been released. It is therefore not possible to determine how many customers, employees or building operators may be involved.

Inside dragonforce

Dragonforce is a ransomware group that lists victim organisations on a public leak site after encrypting their systems. The group follows the common double-extortion pattern seen in recent years: data is removed before encryption, and the threat of publication is used to pressure payment. Its listings are presented as claims by the group; independent confirmation of the underlying access or data theft is not provided by the listing alone.

Lift and its sector

Lift AG was established in 1958 and operates as an independent family-owned manufacturer of elevators and related systems in the German-speaking region of Switzerland. The company installs new equipment, carries out modernisations and holds ongoing maintenance contracts for both residential and commercial buildings. Firms in this sector routinely store technical specifications, access credentials for building systems, customer contact details and service histories.

The information in question

The listing refers only to “internal files.” No inventory of specific data categories has been published. Organisations of this type commonly hold customer names, addresses, contract terms, maintenance logs and limited financial information, as well as employee records. Until Lift AG or an official investigation discloses the contents, the exact nature of the material remains unconfirmed.

What's at stake

Exposed internal files could contain details that allow unauthorised access to building systems or that reveal commercial relationships. For individuals, the main concern is the possible misuse of any personal contact or contract information that may have been stored. For the company, the incident adds operational and reputational pressure at a time when clients expect reliable service continuity for safety-critical equipment.

If your data was in this claimed breach

Monitor email accounts and company correspondence for unusual activity. Review any maintenance contracts or service portals for signs of unauthorised changes and consider updating passwords used for those systems. Individuals can also run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.