STEP Oiltools Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

What happened

The incident came to light when dragonforce added STEP Oiltools to its leak-site listing on July 12, 2026. The group claims that internal files were taken during a ransomware operation. No confirmation of the claim has been issued by STEP Oiltools, and the company has not released a statement describing any operational impact or data exposure.

Public records do not disclose the date of the alleged intrusion, the method of access, the volume of data involved, or whether any files were subsequently published. The number of people potentially affected remains unknown.

Who is dragonforce?

Dragonforce is a ransomware group that has conducted operations against organisations in multiple sectors. Like other groups of its kind, it typically employs encryption of systems combined with the threat of releasing stolen data if a ransom demand is not met. The group maintains a leak site where it lists claimed victims and, in some cases, posts samples of material it asserts was obtained during intrusions.

Its listings are presented by the group itself and are not independently verified at the time they appear. Dragonforce has been linked in public reporting to other claimed incidents involving industrial and commercial targets, though each case requires separate confirmation.

Who is STEP Oiltools?

STEP Oiltools provides solids control and drilling waste management services to the oil and gas and civil engineering industries. Its offerings include separation systems, modular recyclers and dewatering equipment used to improve efficiency and reduce waste during drilling operations. The company states that it serves major energy-sector clients as well as customers in civil construction and water treatment.

Organisations in this sector routinely hold operational records, client contracts, equipment specifications, health-and-safety documentation and internal communications. A breach affecting such a provider can therefore touch both corporate information and data belonging to the clients and projects it supports.

The information in question

The only detail released about the material is that internal files were allegedly exfiltrated. No inventory of file types, no count of records, and no indication of whether personal data of employees, clients or contractors is present have been published.

Because the precise contents remain undisclosed, it is not possible to determine whether names, contact details, financial information or project-specific records are involved. Any assessment of risk to individuals therefore rests on information that has not yet been confirmed.

Why it matters

Industrial-service companies maintain records that can include details about personnel, subcontractors and ongoing projects. If those records contain personal information, individuals may face risks such as targeted phishing, identity misuse or unwanted disclosure of employment or contractual data.

For the organisation, the incident adds to the operational and reputational pressures that follow any ransomware claim, regardless of whether the data is later released. Clients in the energy and construction sectors often require evidence of secure handling of their information, so the listing can trigger additional due-diligence questions even in the absence of confirmed data publication.

If your data was in this claimed breach

Monitor official statements from STEP Oiltools for any further information on the scope of the incident. Enable multi-factor authentication on accounts that may share email addresses or other details held by the company, and review bank and credit statements for unusual activity.

Individuals can also run a free exposure scan of their email address against known breach datasets to check whether their information appears in other publicly reported incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.