Mullinax Ford Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Mullinax Ford was listed by the dragonforce ransomware group on December 25, 2025, after internal files were exfiltrated in an attack whose timing has not been established. Individuals who have done business with the dealership should check for any follow-up notices and consider monitoring their accounts for unusual activity.
People who have done business with Mullinax Ford, a dealership in Apopka, Florida, may have personal or financial information exposed after the organization was listed by the dragonforce ransomware group. The listing, reported on December 25, 2025, indicates that internal files were taken during a ransomware incident, though the number of individuals affected and the precise contents of those files remain unknown.
The incident matters because automotive dealerships routinely collect driver’s license numbers, Social Security numbers, bank details, and service records. When such data appears on a leak site, it can be used for identity theft or fraud long after the initial event.
What happened
On December 25, 2025, the dragonforce ransomware group listed Mullinax Ford on its leak site. The group stated that internal files had been exfiltrated during a ransomware attack. No confirmation of the listing or details on the volume of data have been released by the dealership. The number of people affected is not publicly known, and the timeline of the intrusion itself has not been disclosed.
The group behind it: dragonforce
Dragonforce is a ransomware operation that publicly claims responsibility for intrusions on a dedicated leak site. Like other groups in this category, it typically gains access through phishing, stolen credentials, or unpatched systems, then exfiltrates data before deploying encryption. The group has appeared in multiple public listings involving commercial organizations. In this case, the listing of Mullinax Ford constitutes the group’s claim; independent verification of the data or the attack method has not been provided.
About Mullinax Ford
Mullinax Ford operates as a Ford dealership in Apopka, Florida. Dealerships of this type handle vehicle sales, financing, leasing, and service. These activities require collection and storage of customer identification, credit applications, and vehicle maintenance histories. A breach at such a business can therefore involve records that combine personal identifiers with financial information.
The information in question
The only detail released about the exposed material is that internal files were allegedly exfiltrated. No inventory of specific data fields has been published. Organizations in the automotive retail sector commonly hold names, addresses, driver’s license numbers, Social Security numbers, payment card data, and loan or lease documents. Whether any of these categories are present in the exfiltrated files remains unconfirmed.
What's at stake
Exposed internal files can contain enough personal and financial detail to support identity theft or account takeover. Affected individuals may face fraudulent credit applications or tax filings. For the dealership, the incident creates potential regulatory reporting obligations and costs associated with investigation and customer notification. Both outcomes depend on the actual contents of the files, which have not been specified.
Were you affected?
Begin by monitoring bank and credit accounts for unusual activity. Place a fraud alert or credit freeze with the major bureaus if you have provided identification or financing information to the dealership. Several services allow individuals to check whether their email address appears in known breach data sets; running such a scan provides one limited indicator of exposure. Official statements from Mullinax Ford or regulatory filings may supply additional details as they become available.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Burnex Listed by dragonforce Ransomware GroupBarnes & Jones Listed by dragonforce Ransomware GroupTri-State Metal Roofing Supply Listed by dragonforce Ransomware GroupColonial Metals Listed by dragonforce Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Mullinax Ford Listed by dragonforce Ransomware Group →
Publicly posted by dragonforce — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.