The DRM Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The DRM was listed by the dragonforce ransomware group on June 12, 2026, with internal files reported exfiltrated in the attack; the date of the intrusion itself has not been established. Individuals connected to the organisation are advised to check whether their data may have been exposed and to take any recommended protective steps.
Inside the incident
The only confirmed information is the listing itself and the statement that internal files were allegedly exfiltrated. No date of the intrusion, volume of data, or method of access has been disclosed. The organization has not issued a public statement confirming or denying the claims at the time of reporting.
Who is dragonforce?
DragonForce operates as a ransomware group that publishes victim names on a dedicated leak site when negotiations fail or to apply pressure. The group follows a pattern seen in other ransomware operations: gaining access to networks, copying files, and then encrypting systems. Its listings are presented as claims by the actors and are not independently verified unless the affected organization confirms them.
The DRM and its sector
The DRM, operating as Durrat Resort Management, provides operational, marketing, and guest-services support to luxury resort owners and investors. Companies in this sector routinely collect and store guest profiles, booking records, payment details, and internal operational documents to coordinate services across properties. A compromise at such a firm can affect multiple resorts and the individuals who have stayed at or invested in them.
What data was at risk
The listing refers only to “internal files.” The precise categories of information contained in those files have not been disclosed. Organizations of this type commonly hold guest contact details, reservation histories, financial records, and staff information, but the exact contents remain unconfirmed.
Why it matters
Resort-management records can contain personal and financial details that retain value for identity misuse or fraud long after an incident. For the company, the exposure of internal documents may complicate relationships with resort owners and require additional security reviews. Without Reported Details on the data, the full extent of downstream effects cannot be measured.
If your data was in this claimed breach
Monitor accounts associated with any resort stays or bookings for unusual activity. Enable multi-factor authentication where available and review statements from financial institutions linked to those reservations. Individuals can also run a free exposure scan of their email address against known breach data to check for appearances in public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
stni.co.kr Listed by dragonforce Ransomware Grouphwaseng Listed by dragonforce Ransomware Groupmihana-v.com Listed by dragonforce Ransomware GroupInk Listed by dragonforce Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the The DRM Listed by dragonforce Ransomware Group →
Publicly posted by dragonforce — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.