Diversified Project Services International Listed by DragonForce Ransomware Group

On August 6, 2025, engineering and geomatics firm Diversified Project Services International appeared on the leak site of the dragonforce ransomware group, with the attackers claiming to have exfiltrated internal files during a ransomware incident.

What Public Reporting Shows

Public reporting indicates that DPSI, which provides engineering, surveying, planning, permitting, inspection, energy management and construction management services, was listed by the group on that date. The posting on the dragonforce leak site states that internal files were taken. The exact number of people whose information is contained in the files remains unknown, and the precise volume and types of documents have not been independently verified beyond the group's claims. Available reporting describes the incident as a ransomware attack that included both encryption and data exfiltration, a common pattern for this group.

Why This Matters for You and Your Family

When a company like DPSI suffers a breach, the people most directly affected are often its clients, vendors, employees, and their families. If you have worked with an engineering or surveying firm on a home project, land purchase, energy audit, or construction permit, your personal information could be among the records now in attackers' hands. Internal files frequently contain names, addresses, phone numbers, email accounts, contract details, and payment records. Once exposed, this data can be sold, traded, or used to target you with phishing, identity theft, or harassment. For families, the risk extends beyond the primary account holder: children's names, school information, or family addresses sometimes appear in project records, creating long-term exposure.

The Doxxing and Identity-Chain Implications

Stolen internal files rarely stay isolated. Attackers and subsequent buyers can combine the data with other leaks to build detailed profiles. A phone number from one record links to an email in another; an address ties to social-media handles and children's gaming usernames. These identity chains allow doxxing that escalates quickly from leaked documents to targeted harassment or account takeovers. Credential leaks of this nature often cascade into gaming account compromises because the same email and password combinations are reused across work, personal, and gaming services. Public reporting indicates that such chains are a primary method used after ransomware data dumps to maximize profit through extortion or resale.