George Haney & Son Listed by dragonforce Ransomware Group

On August 23, 2025, family-owned HVAC contractor George Haney & Son Inc appeared on the leak site of the dragonforce ransomware group. The company, based in Pasadena, California, is claimed to have had internal files exfiltrated during a ransomware attack. Customers who provided personal information for service calls, warranties, or payments may now have their data at risk.

Reported Details of the Incident

Public reporting indicates that George Haney & Son, established in 1927, specializes in residential and commercial HVAC installation, maintenance, and repair across the San Fernando and San Gabriel Valleys. The firm serves as a Carrier Factory Authorized Dealer and handles emergency calls for central AC, heating, and mini-split systems.

Available reporting describes the exposure of internal files stolen in the attack. The exact number of individuals affected remains unknown, and the specific types of records posted have not been fully detailed in public summaries. The listing appeared on the dragonforce leak site, which is tracked by ransomware monitoring platforms such as ransomware.live.

Why This Matters for You and Your Family

When a local service company like an HVAC contractor suffers a breach, the people impacted are usually ordinary families who called for repairs, scheduled maintenance, or bought new systems. Names, addresses, phone numbers, email addresses, and payment details provided during those interactions can appear in stolen files. Once that information leaves the company’s control, it can be sold, traded, or used to target you with identity theft, phishing calls, or fraudulent warranty claims.

Residential customer records are especially valuable because they tie physical home addresses to names and contact information. Criminals can combine this data with other leaks to build convincing profiles. For many families, this single breach may be the link that exposes them to broader harassment or financial fraud.

The Doxxing and Identity-Chain Risks

Stolen customer files often contain enough personal details to start an identity chain. An email address from an old service ticket can be matched to gaming accounts, social media handles, or school records. Attackers follow these links to locate children’s usernames, then pivot to doxxing or account takeovers. Credential leaks like this one frequently cascade into gaming platforms where kids use the same passwords or recovery emails as their parents.

Public reporting shows that ransomware groups increasingly publish personal documents to pressure victims. Even if your family was not the primary target, any information tied to your address or phone can be reused in future attacks. The chain can grow quickly once a single reliable data point, such as a home address linked to a parent’s name, enters criminal marketplaces.

Dragonforce Group Track Record

Public reporting attributes the attack to the dragonforce ransomware group. The group emerged in recent years and has targeted organizations of varying sizes with a playbook that typically involves initial access through phishing or exploited remote desktop services, followed by data exfiltration and encryption. They then demand payment and, if unmet, publish samples or full datasets on their leak site to escalate pressure. Notable prior victims have included companies in manufacturing, healthcare, and local service sectors, though exact details vary across reports.

What to do

• Rotate any password you ever used at George Haney & Son anywhere it is reused, and switch to 2FA through an authenticator app instead of text messages.
• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing your family is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same contact details.
• Let remediation specialists perform hands-on takedown requests across data brokers and suspicious sites on your behalf.

The incident shows how quickly a routine service relationship can expose your personal information to professional cybercriminals. Taking deliberate steps now limits how far that data can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-based takeovers. Starting protective measures promptly helps safeguard your family against the expanding ripple effects of leaks like this one.