Promotion AB Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Promotion AB, a Swedish company focused on retail technology solutions, was listed by the dragonforce ransomware group on April 27, 2026. The listing states that internal files were exfiltrated during a ransomware attack. The number of people affected remains unknown, and no further details on the scope or contents of the data have been made public.

Incidents of this kind matter because internal files from organisations that support retail operations can contain records that extend beyond the company itself, potentially touching suppliers, partners, or customers whose information is processed in the course of normal business.

What happened

The only confirmed public information is the listing itself. Dragonforce claims to have obtained internal files from Promotion AB in a ransomware operation. No date of the intrusion, volume of data, or method of access has been disclosed. The company has not issued a public statement confirming or denying the claims at the time of reporting.

Inside dragonforce

Dragonforce is a ransomware group that maintains a leak site where it lists organisations it claims to have targeted. Like other groups in this category, it typically combines encryption of systems with the theft of files, then uses the threat of publication to pressure victims. The group has appeared in multiple public reports over recent years, following patterns seen with other ransomware operators that publish victim names when negotiations stall or to increase leverage.

In this case the listing of Promotion AB stands as an unverified claim by the group. No independent confirmation of the data’s authenticity or extent has been published.

Who is Promotion AB?

Promotion AB was established in 1979. In 2020 it merged with Eclipse Display and describes its focus as providing technology and services that simplify daily operations for retail stores across the Nordic region. Companies of this type commonly handle point-of-sale systems, inventory tools, customer-management platforms, and supplier integrations for physical and online retailers.

Because these services sit at the centre of retail data flows, a breach can affect not only the company’s own records but also information it processes on behalf of client businesses.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No specific categories of data—such as customer records, employee details, financial information, or technical documentation—have been named. The exact contents therefore remain unconfirmed.

Organisations in the retail-technology sector routinely hold contracts, configuration files, partner communications, and operational records. Until further disclosure occurs, it is not possible to state which of these, if any, were taken.

Why it matters

Internal files can reveal how systems are configured, how partners exchange data, and which security controls are in place. Exposure of such material can assist further attacks against the same organisation or its clients. For individuals whose information is processed by Promotion AB’s customers, the practical consequences depend on what the files actually contain—an issue that is still unknown.

For the company, the incident adds operational disruption and the need to assess downstream effects on retail clients that rely on its platforms.

What to do if you're exposed

Monitor official statements from Promotion AB and any notifications sent to affected partners or customers. If personal or account information is later confirmed as exposed, change passwords for any services that may share credentials and enable multi-factor authentication where available. Individuals can also run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.