R.J. Zavoral & Sons, Inc. Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
R.J. Zavoral & Sons, Inc. was listed by the dragonforce ransomware group on February 11, 2026, with internal files reported to have been exfiltrated. The number of individuals affected is undisclosed; anyone who may have shared data with the company should review their accounts and consider protective steps.
On February 11, 2026, the ransomware group dragonforce listed R.J. Zavoral & Sons, Inc. on its leak site, stating that internal files had been taken during a ransomware attack. The number of people affected remains unknown, and the company has not confirmed the incident or released details on the scope of any data exposure.
The listing raises questions for clients, employees, and partners of the Minnesota construction firm, as the exfiltrated material may contain records tied to municipal projects, utility work, and site management across the Red River Valley.
Inside the incident
The only public indication of the event is the February 11, 2026 listing by dragonforce. No official statement from R.J. Zavoral & Sons, Inc. has been issued, and the company has not disclosed whether it received a ransom demand, the volume of data involved, or the timeline of the intrusion. Public records do not yet show any regulatory filings or law-enforcement notifications tied to the claim.
The group behind it: dragonforce
Dragonforce is a ransomware operation that maintains a public leak site where it posts names of organizations it claims to have targeted. Like similar groups, it typically combines encryption of systems with the theft of files, then uses the threat of publication to pressure victims. The group’s listings are unverified claims until corroborated by the affected organization or independent investigation; several prior listings have later been disputed or shown to involve limited or already-public material.
R.J. Zavoral & Sons, Inc. and its sector
R.J. Zavoral & Sons, Inc. was established in 1951 and operates as an earth-moving and construction contractor based in East Grand Forks, Minnesota. Its work includes asphalt paving, road and rail construction, site preparation, underground utilities, and flood-mitigation projects for municipalities, private businesses, and industrial clients in the Red River Valley. Construction contractors routinely maintain records on bids, contracts, employee data, equipment, and project specifications that involve public infrastructure.
The information in question
The listing states only that “internal files” were exfiltrated. No inventory of file types, no count of records, and no confirmation of personal information have been released. Organizations in this sector commonly hold employee records, subcontractor agreements, client contact details, project plans, and financial documentation; however, the precise contents of any exfiltrated material in this case remain unconfirmed.
What's at stake
If the files contain personal or financial information, affected individuals could face risks of identity misuse or targeted fraud. For the company and its municipal clients, exposure of project or bidding data could affect competitive positions or contractual obligations. At present, the scale of these risks cannot be quantified because the number of records and their sensitivity have not been disclosed.
What to do if you're exposed
Individuals who have worked with or for R.J. Zavoral & Sons, Inc. should monitor their financial accounts and credit reports for unusual activity. Changing passwords for any accounts linked to the company and enabling multi-factor authentication are standard first steps. Readers can run a free exposure scan of their email address to check whether their information has appeared in known breach data sets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
CF Evans Construction Listed by dragonforce Ransomware Groupbreslinbuilders.com Listed by dragonforce Ransomware GroupAsmar Schor & McKenna Listed by dragonforce Ransomware Groupgreenwayfence.com Listed by dragonforce Ransomware GroupLatest breaches
Publicly posted by dragonforce — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.