Moncaro Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations of every size by pairing encryption with data theft and public leak-site listings, a pattern that has become a routine feature of the current threat landscape. In this environment even specialised regional producers can find themselves named on criminal forums, turning operational disruption into a potential privacy and reputational problem for staff, partners and customers.

On 10 March 2025 the Italian wine cooperative Moncaro was listed by the ransomware group known as dragonforce. Public reporting states that internal files were exfiltrated during a ransomware attack; the number of people affected remains unknown and further technical detail has not been released. The listing itself is a claim by the group and has not been independently confirmed in the available record.

Inside the incident

According to the reported summary, Moncaro appeared on dragonforce’s leak site on or around 10 March 2025. The only concrete description of the compromise is that internal files were allegedly exfiltrated in the course of a ransomware attack. No public statement has disclosed the precise date of initial access, the entry vector, the volume of data taken, whether systems were encrypted, or whether a ransom demand was issued or paid. The number of individuals whose information may have been involved is listed as unknown. Beyond the group’s claim that it holds Moncaro material, no independent verification of the stolen data set has been published.

Who is dragonforce?

Dragonforce is a ransomware operation that has been observed operating a double-extortion model: encrypting victim systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. Like many contemporary groups, it has advertised itself through public listings of claimed victims across multiple sectors and geographies. Its tactics typically include the use of commodity and custom tools for initial access, lateral movement and data exfiltration, followed by the staged release of sample files to pressure organisations. The group’s listing of Moncaro should be treated as an unverified claim; the facts supplied for this incident do not state that the group successfully retained or published any specific Moncaro files.

Who is Moncaro?

Moncaro is a long-established wine cooperative based in Italy’s Le Marche region. It is built around local agriculturalists and vineyards and plays a recognised role in the economic activities linked to traditional viniculture. The organisation emphasises research and conservation of the biodiversity of the region’s micro-environments and collaborates with universities on projects that support the memory of the land and the maintenance of its economic, social and landscape structures. As a producer and cooperative, Moncaro routinely handles commercial, agricultural, logistical and personnel information typical of a mid-sized food-and-beverage enterprise that also maintains relationships with growers, distributors, research partners and end customers. A ransomware incident at such an organisation therefore carries consequences that extend beyond pure IT recovery into supply-chain continuity and the protection of personal and commercial data.

What was likely exposed

The only data category named in the public record is “internal files” exfiltrated during the ransomware attack. No inventory of file types, databases or record counts has been released, and the number of people affected is unknown. Organisations of Moncaro’s type commonly hold employee records, grower and supplier contracts, production and quality-control documentation, customer and distributor contact details, financial and logistics data, and research materials related to viticulture and biodiversity. Whether any of these categories were among the files claimed by dragonforce remains unconfirmed. Readers should therefore treat the precise contents of the alleged exfiltration as undisclosed.

The real-world impact

For individuals whose information may have been present in internal files, the practical risks include unwanted contact, phishing attempts that leverage stolen context, and, in the case of identity or financial data, longer-term fraud exposure. Because the exact data types and the number of people affected are unknown, the scale of personal impact cannot yet be quantified. For Moncaro itself the consequences centre on operational disruption, potential regulatory notification obligations under European data-protection rules, reputational damage among growers and buyers, and the cost of forensic investigation, system restoration and any required customer or partner communications. The cooperative’s role in regional agricultural networks means that prolonged downtime or loss of trust could also affect associated small producers and local economic activity.

If your data was in this claimed breach

If you have a past or present relationship with Moncaro—as an employee, grower, supplier, research partner or customer—treat the possibility of exposure seriously even while the full scope remains unconfirmed. Monitor financial and email accounts for unusual activity, enable multi-factor authentication wherever available, and be alert to phishing messages that reference the company or the wine sector. Consider placing fraud alerts with relevant credit agencies if you believe identity data may have been involved. You can also run a free exposure scan of your email address to check whether it has already appeared in other known breach data sets; such a check provides an early signal but does not replace official notifications from the organisation itself. Keep records of any correspondence you receive from Moncaro or its advisers so that you can act promptly if further guidance is issued.

AICompiled with AI assistance from public sources and published under our editorial standards.