Öztekin Group Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 4, 2026, the ransomware group dragonforce listed Öztekin Group on its leak site, stating that internal files had been exfiltrated during a ransomware attack. The number of people whose data may be involved is not known, and no further details about the volume or contents of the material have been made public. The incident raises immediate questions for clients, employees, and partners of the Turkish construction firm, whose projects span industrial, residential, and commercial buildings. Even without confirmed personal data, the exposure of internal files can affect contract terms, technical specifications, and correspondence that individuals or organisations would reasonably expect to remain private.

Inside the incident

Public reporting on the event is limited to the listing itself. The date the files were taken, the method of initial access, and whether any ransom demand was issued or met have not been disclosed. No official statement from Öztekin Group confirming or denying the claims has appeared in available records.

Who is dragonforce?

Dragonforce is a ransomware operation that has been publicly tracked since at least 2023. The group typically gains access to corporate networks, deploys encryption, and removes copies of files before demanding payment. When organisations refuse or ignore the demand, the group lists the victim on a leak site and may release portions of the stolen material. Its listings function as a public claim of responsibility rather than independently verified evidence of the breach.

About Öztekin Group

Öztekin Group designs and constructs industrial, residential, and commercial buildings. The company states that its work follows established engineering standards and focuses on delivering projects on agreed terms. Organisations in this sector routinely store client records, supplier contracts, employee information, technical drawings, and financial documentation related to ongoing and completed work.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific file types or data categories has been released. Construction firms commonly hold personal details of staff and subcontractors, project correspondence, and commercial agreements; however, whether any of these categories are present in the claimed exfiltration remains unconfirmed.

Why it matters

Exposure of internal files can lead to secondary misuse such as targeted fraud, competitive intelligence gathering, or further social-engineering attempts against the same organisation and its contacts. For individuals named in contracts or personnel records, the practical consequences depend on the exact data involved, which has not been specified. The organisation itself faces potential disruption to project timelines and additional costs for investigation and remediation.

Were you affected?

Individuals who have worked with Öztekin Group as employees, contractors, or clients can begin by monitoring their email and financial accounts for unusual activity. They may also contact the company directly to ask what information, if any, was involved. A free exposure scan of an email address against known breach datasets can provide an initial indication of whether the address has appeared in previously published data.

AICompiled with AI assistance from public sources and published under our editorial standards.