PAN Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 20, 2025, the ransomware group dragonforce listed PAN, operating as Pan Emirates Furniture, on its data-leak site. The listing asserts that internal files were taken during a ransomware intrusion. No figure has been released for the number of individuals whose information may be involved, and the company has not issued a public statement confirming or detailing the event.

Incidents of this kind continue to appear across retail and manufacturing supply chains, where operational data can hold value for both disruption and resale. Public information remains confined to the group’s claim and the narrow description of “internal files” having been removed.

Breaking down the breach

The only confirmed public record is the November 20, 2025 listing itself. The group states that files were exfiltrated prior to or alongside encryption activity, yet no volume, file categories, or timeline of the intrusion has been disclosed. The number of people potentially affected is listed as unknown, and no independent verification of the data’s contents or scope has been published.

The group behind it: dragonforce

Dragonforce operates as a ransomware-as-a-service affiliate model, posting victim names on a dedicated leak site when negotiations fail or data is taken. The group’s pattern includes both encryption of systems and the publication of stolen material to increase pressure. Its listings have previously covered organisations in multiple sectors, though each claim requires separate confirmation because the site functions as an unverified assertion by the actors themselves.

PAN and its sector

Pan Emirates Furniture was established in 1991 by Abdul Rahman Al Shamsi and has grown into a regional wholesaler and retailer of home and office furniture along with related accessories. Companies in this sector routinely maintain supplier contracts, inventory records, customer order histories, pricing structures, and internal communications. A successful intrusion can therefore expose both commercial relationships and personal details of individuals who have interacted with the business.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No further breakdown of file types or data categories has been released. Organisations of this kind commonly store customer names, addresses, contact information, purchase records, and employee data alongside operational documents; however, whether any of these specific categories were taken remains unconfirmed.

What's at stake

Exposed internal files can reveal business relationships, pricing agreements, and personal identifiers that may be used for targeted fraud or sold on underground forums. For individuals, the primary risks involve misuse of contact or transaction data. For the organisation, the incident adds costs related to investigation, potential regulatory reporting, and restoration of systems, regardless of whether the group’s claims are later substantiated.

Were you affected?

Individuals who have purchased from Pan Emirates Furniture or provided personal details to the company should monitor their accounts for unusual activity and consider placing fraud alerts with credit agencies where available. Checking whether an email address appears in known breach datasets can be done through free public exposure scanning services offered by several cybersecurity organisations. Any direct notification from the company would provide the most authoritative information on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.