McCOR Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

McCOR, a Canadian real estate and property management company, was listed by the dragonforce ransomware group on April 15, 2026. The number of people affected is not known, and the only confirmed detail is that internal files were allegedly exfiltrated during a ransomware attack. The practical implications depend on the contents of those files and whether they include personal information belonging to tenants, clients, or employees.

What happened

The incident was reported on April 15, 2026, when the dragonforce group listed McCOR on its leak site. The listing states that internal files were taken in a ransomware attack. No further details on the timing of the intrusion, the volume of data, or the method of access have been made public. The number of individuals whose information may be involved remains undisclosed.

The group behind it: dragonforce

Dragonforce is a ransomware operation that has appeared in multiple public listings involving corporate victims. Groups of this type typically gain initial access through phishing, stolen credentials, or unpatched systems, then move laterally to locate and copy data before deploying encryption. Their listings on leak sites serve as a form of pressure on the targeted organization. In this case the group claims to hold files from McCOR; that claim has not been independently verified beyond the listing itself.

McCOR and its sector

McCOR operates as a real estate and property management firm in Canada, providing services across commercial, retail, and residential properties. Its work includes investment management, leasing, advisory services, and project oversight for development clients. Organizations in this sector routinely collect and store records related to tenants, property transactions, financial arrangements, and operational contracts. A breach at such a firm can expose information that spans multiple parties connected to the properties under management.

What data was at risk

The only data type named in connection with the incident is internal files exfiltrated during the ransomware attack. No inventory of specific documents, file categories, or data fields has been released. Companies of this kind commonly hold lease agreements, tenant contact details, financial ledgers, and employee records, yet the precise contents of the exfiltrated material are unconfirmed.

What's at stake

For individuals, exposure of internal files could lead to misuse of contact information, financial details, or identifiers if those elements are present. For the organization, the incident adds costs related to investigation, potential regulatory reporting, and restoration of systems. The absence of Reported Details on scale or data types means the full extent of consequences cannot yet be measured.

If your data was in this claimed breach

Monitor accounts for unusual activity and consider placing fraud alerts with credit reporting agencies where applicable. Change passwords for any services linked to McCOR and enable multi-factor authentication on those accounts. Readers can run a free exposure scan of their email address against known breach data to check for appearances in previously published sets.

AICompiled with AI assistance from public sources and published under our editorial standards.