I.L.A. Local 1964 Listed by dragonforce Ransomware Group

On May 29, 2024, the dragonforce ransomware group listed I.L.A. Local 1964 on its leak site, claiming that internal files had been exfiltrated from the union during a ransomware attack. The International Longshoremen’s Association Local 1964, which represents workers ranging from ocean shipping and trucking to nurses aides, dialysis technicians, building maintenance staff, grocery store clerks, and laundry workers, now faces the public exposure of its internal documents. Anyone whose employment, health, or pension records are held by the union may be affected.

Reported Details from the Listing

The dragonforce leak-site entry states that internal files were exfiltrated following a ransomware deployment. The listing does not disclose the volume of data taken, the exact file types, or any specific member records. It simply states that negotiation-related and operational documents from the chartered-1970 union local were removed. No ransom demand figure or payment deadline appears in the public posting. The primary source remains the dragonforce leak page itself, aggregated on ransomware.live.

Why This Matters for You and Your Family

If you or a family member works in shipping, logistics, healthcare support, or any of the trades covered by Local 1964, your personal information may sit inside the stolen files. Union records routinely contain Social Security numbers, home addresses, dates of birth, health-benefit details, pension enrollment data, and direct-deposit banking information. Once these records leave the union’s control, they can be sold, published in full, or used to file fraudulent tax returns, open credit accounts, or demand payment from victims directly. Even if your name is not on the first batch of leaked samples, the precedent is clear: ransomware operators release more data over time to increase pressure.

Doxxing and Identity-Chain Risks

Exposed union files create long-term doxxing chains. An attacker who obtains your work email, phone number, or member ID from Local 1964 can cross-reference it with breached gaming accounts, social-media handles, or family addresses. This linkage turns a single breach into persistent identity exposure. Children’s accounts are especially vulnerable because many parents reuse the same password or security questions across work-related services and family gaming logins. A credential pair taken from the union today can unlock a child’s Roblox, Fortnite, or Discord account tomorrow, leading to further harassment or additional data theft.

Dragonforce’s Known Track Record

Public reporting attributes the dragonforce ransomware group with emerging in late 2023. The operators have targeted mid-sized organizations across North America and Europe, including manufacturing, logistics, and nonprofit entities. Their typical playbook begins with initial access gained through phishing or exploited remote-desktop credentials, followed by rapid exfiltration of internal shares before encryption. Extortion then proceeds in two stages: first a private ransom demand, then public listing on their leak site with samples and countdown timers if payment is not received. The group rebrands and rotates infrastructure frequently, which complicates blocking but does not change the core financial motive.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity, then use the cleanup to remove what you can.
• Rotate any password you have ever used for Local 1964 member portals or union email anywhere else it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught and acted on within hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address or reused credentials.
• Let remediation specialists handle ongoing takedown requests for any exposed documents or broker listings that surface from this incident.

The breach of I.L.A. Local 1964 is a reminder that even organizations built to protect workers can become gateways to personal exposure for the very members they serve. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today and close the gaps before the next leak appears.