coBuilder Listed by DragonForce Ransomware Group

On June 17, 2025, construction technology company Cobuilder appeared on the leak site of the dragonforce ransomware group after internal files, including complete databases, were allegedly exfiltrated in a ransomware attack.

What Public Reporting Shows

Public reporting indicates that Cobuilder, which provides digital collaboration tools, asset data management, digital product passports, and sustainability reporting for the construction industry, had its systems compromised. The attackers extracted internal documents and databases before encrypting systems or demanding payment. No confirmed victim count has been released, and the precise number of individuals whose information may have been exposed remains unknown. Available reporting describes the data as internal files that could contain business records, partner details, and potentially personal information tied to clients or employees.

The incident follows the group’s typical pattern of exfiltrating data prior to encryption and later publishing samples as proof. The primary source is the dragonforce leak site itself, mirrored by ransomware tracking services such as ransomware.live.

Why This Matters for You and Your Family

When a company like Cobuilder suffers a breach, the information exposed often includes names, email addresses, phone numbers, or other details that can be linked back to you or members of your household. Even if you never directly used Cobuilder’s platform, your data may have been shared by a construction firm, supplier, or contractor that did. Credential leaks like this one frequently cascade into account takeovers elsewhere because people reuse passwords across services.

For families this can mean sudden risks ranging from phishing emails that sound legitimate to more sophisticated identity theft attempts. Children’s accounts, especially gaming logins tied to family email addresses or phone numbers, become easy targets once a single piece of information surfaces. The breach therefore affects not only the company’s direct customers but anyone whose details ended up in those databases.

The Doxxing and Identity-Chain Implications

Stolen internal files and databases provide attackers with enough breadcrumbs to map relationships between email addresses, usernames, phone numbers, and real-world identities. Once one account is compromised, attackers can pivot to linked services, reset passwords, or sell the chain on underground forums. This is exactly how isolated breaches turn into persistent doxxing campaigns that expose home addresses, family member names, and even children’s online profiles.

Credential leaks like this one are particularly dangerous for gaming accounts. A teenager’s username and email reused from a family account can quickly lead to full takeover, harassment, or further data sales. Without visibility into these connections, most people discover the damage only after fraudulent charges appear or strangers begin contacting them.

Dragonforce’s Publicly Known Track Record

Public reporting attributes the dragonforce ransomware group with emerging in late 2023. The group has targeted organizations across multiple sectors, often listing victims on its dark-web leak site after exfiltrating data. Its typical playbook involves initial access through phishing or exploited vulnerabilities, followed by claimed exfiltration of sensitive files, deployment of ransomware, and then extortion through both encryption and data-leak threats. Notable prior victims include companies in technology, manufacturing, and professional services, though exact details vary by incident. The group’s leak site is used to publish proof files and pressure targets into payment.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what chains back to the Cobuilder breach.
• Rotate any password you used at Cobuilder or related construction platforms anywhere it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same contact details.
• Let remediation specialists handle takedown requests across data brokers and exposed records while you focus on securing accounts at home.

The Cobuilder incident is a reminder that construction-industry digital tools now hold personal data that can affect ordinary families far beyond the building sector. Taking concrete steps now limits how far attackers can travel along the identity chain. DoxxScan by GalaxyWarden offers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Starting that process promptly gives you visibility and control long before the next leak appears on a ransomware site.