PER4MANCE Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 18 August 2024, the Czech systems integrator PER4MANCE appeared on a listing published by the ransomware group dragonforce. The group claims that internal files were taken during a ransomware attack. Public detail remains limited: the number of people whose information may be involved is unknown, and the precise contents of the files have not been confirmed beyond the description of internal material. For employees, partners, clients and suppliers who work with the firm, that uncertainty is the practical starting point—any personal or business data held in internal systems could, in principle, be among what was taken.

Because the scale and exact data types are undisclosed, those who have dealt with PER4MANCE cannot yet know whether their own records are affected. The listing itself is a claim by the group; independent verification of the full scope has not been made public. What follows sets out only what is known, the background of the actors involved, and the concrete steps people can take while further detail is awaited.

Inside the incident

According to the available record, PER4MANCE was listed by dragonforce on 18 August 2024. The group states that internal files were exfiltrated in a ransomware attack. No public figure has been given for the volume of data, the number of systems involved, or the number of individuals whose information may have been present. The method of initial access, the duration of any dwell time inside the network, and whether encryption was also deployed remain undisclosed. The listing is therefore treated as an unverified claim by the group rather than a confirmed forensic finding.

No official statement from PER4MANCE detailing the incident, any containment measures, or notifications to regulators or affected parties has been included in the public facts available for this account. Timing beyond the reported listing date is likewise unconfirmed. In short, the public record establishes only that the company was named on the group’s leak site in connection with an alleged ransomware incident involving internal files; everything else is presently unknown.

The group behind it: dragonforce

Dragonforce is a ransomware operation that has been active in recent years and is known for a double-extortion model: data is stolen before systems are encrypted, and the group then threatens to publish the material on a dedicated leak site if a ransom is not paid. Like other ransomware-as-a-service groups, it has been observed recruiting affiliates who carry out intrusions and share proceeds. Public reporting has linked the group to attacks across multiple sectors and geographies, typically advertising victims on its site with claims of data theft.

In this case the group claims that PER4MANCE’s internal files were exfiltrated. No further statements attributed specifically to dragonforce about this victim—such as sample file lists, ransom demands, or deadlines—appear in the facts provided. Readers should therefore treat the listing as the group’s assertion, not as independently verified fact, until additional confirmation emerges.

PER4MANCE and its sector

PER4MANCE is headquartered in Brno and has operated since April 1995. It describes itself as a specialist systems integrator on the Czech market, building relationships as a value-added reseller, distributor and partner with a range of original equipment manufacturers. The company has developed a client base that includes large commercial organisations in the Czech Republic, supported by a technical team that delivers integration and related services.

Systems integrators of this type sit between technology vendors and end customers. They typically hold contracts, technical documentation, configuration data, contact details for client staff, and sometimes credentials or network diagrams needed to design and support IT environments. A breach at such a firm can therefore affect not only its own employees but also the blue-chip clients and partners whose information is stored for project delivery. That intermediary position is why an incident here carries wider consequences than a breach confined to a single end-user organisation.

The information in question

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data categories—such as names, email addresses, financial records, or technical credentials—has been publicly confirmed. Organisations in the systems-integration sector commonly hold employee records, client contact lists, project documentation, commercial agreements and system configuration material. Whether any of those categories were present in the files claimed by dragonforce remains unconfirmed.

Because the exact contents are undisclosed, it is not possible to state as fact that particular types of personal or business data were exposed. Anyone who has supplied information to PER4MANCE should assume that internal systems may have contained it, while recognising that this remains an assumption until more detail is released.

What's at stake

For individuals, the main risks are secondary misuse of any personal or contact data that may have been present: phishing that references genuine business relationships, social-engineering attempts that exploit knowledge of projects or colleagues, or credential stuffing if login details were stored. For client organisations, the concern is that technical or commercial documents could give attackers insight into their own environments or negotiating positions. PER4MANCE itself faces operational disruption, potential contractual and regulatory obligations under Czech and European data-protection rules, and the longer-term cost of investigation and remediation.

None of these outcomes is certain; they depend on what was actually taken and how it is later used. The absence of confirmed numbers or file lists means the real-world impact cannot yet be quantified. The prudent stance is to treat the possibility of exposure as real while waiting for clearer information from the company or from independent analysis of any published material.

Were you affected?

If you have worked for, contracted with, or supplied data to PER4MANCE, treat the listing as a prompt to take basic protective steps. Public confirmation of individual impact is not yet available, so these measures are precautionary rather than a response to a verified personal breach.

• Change passwords for any accounts that may have been used in dealings with the company, and enable multi-factor authentication where it is offered.
• Watch for unexpected emails or calls that reference PER4MANCE projects or contacts; verify such approaches through a separate, known channel before responding.
• Review bank and credit statements for unfamiliar activity if financial details were ever shared.
• Keep records of any notification you later receive from the company or from a data-protection authority.
• Run a free exposure scan of your email address against known breach data sets to see whether your information has already appeared in other incidents; this does not confirm or rule out involvement in the PER4MANCE listing, but it can surface other exposures that require attention.

Further official updates from PER4MANCE or from Czech authorities will be the most reliable source of confirmation. Until then, the practical response is limited to the steps above and continued monitoring of trusted news and regulatory channels.

AICompiled with AI assistance from public sources and published under our editorial standards.