NewNet Listed by dragonforce Ransomware Group: What Was Exposed & What To Do

NewNet S.A., a Colombian firm that specializes in IT risk management and cybersecurity services, has been listed by the ransomware group dragonforce as a victim of a data breach. The listing was reported on July 18, 2026. Public detail remains limited: the number of people affected is unknown, and the only data type named is internal files said to have been exfiltrated in a ransomware attack.

Because NewNet advises other organizations on information security, business continuity, and governance, risk, and compliance, any confirmed compromise of its internal material would carry weight for clients and partners who rely on the company for protective services. At present the claim rests on the group’s leak-site listing and has not been independently verified in the available record.

What happened

According to the reported information, dragonforce listed NewNet on its leak site in connection with a ransomware attack in which internal files were exfiltrated. The listing was reported on July 18, 2026. No further operational detail—such as the precise date of intrusion, the initial access method, the volume of data taken, or any ransom demand—has been disclosed in the public facts. The number of individuals affected is recorded as unknown. The incident is therefore known only through the group’s claim and the high-level description of internal-file exfiltration; confirmation from NewNet or independent investigators is not part of the available record.

The group behind it: dragonforce

Dragonforce is a ransomware operation that has appeared in public reporting as a group that conducts double-extortion attacks: encrypting systems while also copying data and threatening to publish it on a dedicated leak site if payment is not made. Like other actors in this category, it typically advertises victims on that site to apply pressure. Well-documented public accounts describe the group as opportunistic in its targeting and reliant on the visibility of its leak portal to amplify leverage.

In this case the sole specific claim tied to NewNet is the listing itself and the assertion that internal files were exfiltrated. No additional statements attributed to dragonforce about this particular victim—such as sample files, exact data volumes, or timelines—appear in the facts provided. The listing should therefore be treated as an unverified claim by the group rather than as confirmed fact.

NewNet and its sector

NewNet S.A. is a Colombian company that has operated since 1996. It specializes in managing IT risks and supplies advanced, personalized data-protection services. Its portfolio covers information security, cybersecurity, business continuity, and governance, risk, and compliance (GRC) solutions. The firm serves multiple sectors through consulting, technology, and managed services intended to keep clients’ IT operations secure and reliable, and it works with recognized manufacturers.

Organizations in this sector routinely hold sensitive material: client contracts, security assessments, network diagrams, incident-response plans, credentials used in managed services, and internal policy documents. A breach at a provider whose business is the protection of others’ systems is consequential because it can undermine trust, expose secondary parties whose data resides in the provider’s environment, and create knock-on risk for the clients who depend on those services.

What was likely exposed

The facts name only “internal files exfiltrated in ransomware attack.” No inventory of specific file types, databases, or personal-data categories has been disclosed, and the number of people affected remains unknown. Exact contents are therefore unconfirmed.

Companies that deliver cybersecurity consulting, managed security, and GRC services typically maintain internal repositories that can include employee records, client engagement files, technical configurations, vulnerability reports, and business-continuity documentation. Whether any of those categories were among the files dragonforce claims to have taken cannot be established from the public record. Readers should treat any more granular description as speculative until verified sources release it.

What's at stake

For individuals whose information may have been inside NewNet’s systems—employees, contractors, or client personnel—the practical risks include phishing that leverages internal knowledge, credential stuffing if passwords or tokens were stored, and social-engineering attempts that reference real project or contact details. Because the scale is unknown, it is not possible to quantify how many people face these exposures.

For NewNet itself and for its clients, the stakes include potential disruption of managed services, loss of confidential security assessments that could aid further attacks on client environments, regulatory or contractual notification obligations, and reputational damage in a market that prizes trust. Clients may need to review whether any shared credentials, remote-access arrangements, or sensitive deliverables require rotation or additional monitoring. None of these outcomes is confirmed; they are the ordinary consequences that follow when a security-services firm is claimed as a ransomware victim and internal files are said to have left its control.

What to do if you're exposed

If you have a past or present relationship with NewNet—as an employee, contractor, or client contact—monitor account activity and be alert to unexpected messages that reference internal projects or colleagues. Change passwords on any accounts that may have been used in connection with the company, enable multi-factor authentication where it is available, and treat unsolicited requests for credentials or payments with caution. Keep an eye on financial and credit activity for unusual behavior.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for personal monitoring while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.