UBS Office Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware operations remain a persistent feature of the threat landscape, with groups frequently listing claimed victims on dedicated leak sites to apply pressure. On January 02, 2026, UBS Office appeared on a listing attributed to the dragonforce group, which stated that internal files had been exfiltrated during a ransomware attack. The number of people affected has not been disclosed, and no further confirmation of the incident or its scope has been made public.

What happened

The incident came to light through a listing on January 02, 2026, under the name UBS Office. The dragonforce group claims to have carried out a ransomware attack that resulted in the exfiltration of internal files. No details on the timing of the intrusion, the volume of data involved, or the method of access have been released. The number of individuals potentially affected remains unknown.

Who is dragonforce?

Dragonforce is a ransomware group that maintains a public leak site where it lists organizations it claims to have targeted. Such groups commonly employ double-extortion tactics, combining encryption of systems with the removal of data to increase leverage. Public records show the group has been active against entities in multiple sectors, though specific claims regarding any single victim require independent verification.

Who is UBS Office?

UBS Office, also referred to as United Business Systems, provides document management services that include printers, copiers, print management, and cloud-based solutions. The organization focuses particularly on the education sector while serving other industries. Companies of this type routinely handle operational records, client contracts, and configuration data tied to document workflows.

What data was at risk

The listing states that internal files were exfiltrated. The precise categories of information contained in those files have not been disclosed. Organizations in the document-management sector typically process records related to client operations, device configurations, and service agreements, but the exact contents of any exfiltrated material remain unconfirmed.

The real-world impact

Exposure of internal operational files can create follow-on risks for the organization and its clients, including potential misuse of configuration details or contractual information. Because the scale of the incident is undisclosed, the extent of any downstream effects on individuals or partner institutions cannot yet be assessed. The organization has not published statements on remediation or notification steps.

What to do if you're exposed

Individuals who have interacted with UBS Office or similar service providers should monitor accounts for unusual activity and review any direct communications from the company. A short list of initial steps includes:

• Change passwords for any accounts linked to the organization and enable multi-factor authentication where available.
• Watch for unsolicited messages that reference document services or request verification.
• Run a free exposure scan of your email address against known breach data to check for surfaced information.

AICompiled with AI assistance from public sources and published under our editorial standards.