Pay Tel Communications Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose communications or personal records may have passed through systems used in jails and detention facilities face a concrete risk when those systems are claimed to have been compromised. On June 25, 2025, the ransomware group dragonforce listed Pay Tel Communications as a victim, asserting that internal files had been taken. The number of individuals affected remains unknown, and public detail is limited, yet the nature of the claimed material—call recordings, mail scans, and work documents—means the stakes for detainees, their families, and facility staff are immediate and personal.

This article sets out only what has been reported, attributes the group’s claims clearly, and outlines practical steps for anyone who may be concerned. No confirmation of the full scope has been made public beyond the listing itself.

What happened

Pay Tel Communications was listed by the dragonforce ransomware group on or around June 25, 2025. According to the group’s claim, the incident involved a ransomware attack in which internal files were exfiltrated. The number of people affected is unknown. Timing of the intrusion, the precise method of access, and any ransom demand details have not been disclosed in the available record. The listing itself constitutes the primary public assertion that a breach occurred; independent verification of the full extent has not been reported.

The group further claimed that the taken material included more than 10,000 video call recordings, more than 10,000 audio call recordings, more than 20,000 scans of physical mail, and more than 70,000 work-related documents. A partial list of facilities was also referenced: Alexander County NC, Alleghany County Jail NC, and Alleghany C. Public detail beyond these assertions is limited.

The group behind it: dragonforce

Dragonforce is a ransomware operation that has been publicly documented for targeting organizations, encrypting systems, and publishing stolen data on leak sites when demands are not met. Like other groups in this category, it typically claims responsibility by posting victim names and sample data descriptions to pressure payment. Its listings are claims, not independently Reported Facts, and should be treated as such unless confirmed by the affected organization or authorities.

In this case, dragonforce has listed Pay Tel Communications and described the exfiltrated files. No additional statements attributed specifically to this incident beyond the listing and the data categories named above appear in the available record. The group’s broader pattern of activity is well-established in public reporting on ransomware actors, but those patterns do not automatically confirm every detail of any single claim.

Pay Tel Communications and its sector

Pay Tel Communications, Inc. provides technology solutions intended to support safety and efficiency inside confinement facilities and to serve the needs of incarcerated individuals. Its offerings include secure communication platforms, educational resources, and multi-function tablets used by detainees. Organizations of this type sit at the intersection of corrections technology and personal communications; they routinely handle call records, messaging, mail processing, and related administrative files for jails and detention centers.

A breach affecting such a provider is consequential because the data often involves people who have limited ability to monitor or control how their information is stored. Facilities that rely on these systems may also face operational disruption or secondary privacy obligations. The partial list of North Carolina facilities named in the claim underscores that the impact, if confirmed, would not be limited to a single site.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. The group claims the material includes the following concrete categories:

• 10,000+ video call recordings
• 10,000+ audio call recordings
• 20,000+ scans of physical mail
• 70,000+ work-related documents

Exact contents beyond these claimed volumes remain unconfirmed. Organizations that supply secure communications and tablet services to confinement facilities typically hold call metadata and recordings, scanned correspondence, account details for detainees and contacts, and internal operational documents. Whether any particular individual’s data is among the files is not known from public sources. The number of people affected is listed as unknown.

What's at stake

For individuals whose calls or mail may have been processed through the systems, the primary risks are privacy exposure and potential misuse of personal details. Recorded conversations and scanned letters can reveal family relationships, legal matters, medical references, or financial information. Work-related documents may contain staff or facility operational data that could be sensitive if released. Because the affected population includes incarcerated people and their outside contacts, the ability to respond quickly or change contact methods is often constrained.

For Pay Tel Communications and the facilities named, the stakes include possible regulatory scrutiny, contractual obligations to notify affected parties, and the need to restore or secure systems. No dollar figures, confirmed notification timelines, or statements of fault appear in the available facts. The absence of a confirmed headcount means the full human scale cannot yet be assessed.

What to do if you're exposed

If you or a family member used communication services linked to facilities that rely on Pay Tel Communications, treat the situation as a potential exposure until more is known. Practical first steps include monitoring accounts for unusual activity, being cautious of unexpected contacts that reference jail communications or personal details, and documenting any suspicious outreach. Contact the facility or the company through official channels if you need confirmation about your own records. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Remain alert for further official notices, as public detail on this incident is still limited.

AICompiled with AI assistance from public sources and published under our editorial standards.