LiftPRO Listed by dragonforce Ransomware Group

On December 16, 2025, industrial lifting and rigging company LiftPRO appeared on the leak site of the dragonforce ransomware group in a listing claiming internal files were exfiltrated during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates that dragonforce listed LiftPRO on its data-leak portal and claims to have stolen internal company files. The exact number of people whose information may have been exposed remains unknown. Available reporting describes the incident as a classic ransomware operation in which attackers first gained access, exfiltrated data, and then threatened to publish it unless a ransom was paid.

LiftPRO, which has operated for more than 40 years, supplies slings, rigging hardware, custom fabrication, and on-site training to transportation, military, and other industrial clients worldwide. The files taken are understood to be internal documents rather than customer databases, though the full scope has not been publicly detailed.

Why This Matters for You and Your Family

When a company you have done business with loses control of its files, your personal or payment information may be among the records. Even if you never bought a sling or attended a training course, vendors, partners, and contractors often share names, addresses, phone numbers, and email accounts that can be linked back to you and your household.

Credential leaks like this one cascade quickly. A single exposed email and password combination from a supplier portal can be tested against your banking, email, and shopping accounts. Children’s accounts are especially vulnerable because families frequently reuse passwords or email addresses across adult work accounts and kids’ gaming logins. Once one account falls, attackers can map relationships, harvest more data, and sell or publish the chain.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at posting a single company’s files. They publish samples to prove they hold the data, then wait for payment. If none arrives, larger batches appear. The released material often contains spreadsheets, contracts, employee lists, or vendor contacts that link names to addresses, phone numbers, and sometimes Social Security numbers or dates of birth.

These fragments become building blocks for doxxing. Attackers or opportunistic criminals combine them with information from other breaches to create detailed profiles. A seemingly harmless rigging-supplier invoice can reveal where you live, what vehicles you operate, and which family members share the same email domain. That profile then fuels identity theft, targeted phishing, or extortion attempts against you or your children.

Dragonforce’s Publicly Known Track Record

Public reporting attributes dragonforce with emerging in 2024 as a ransomware-as-a-service operation. The group has claimed responsibility for attacks on organizations across multiple sectors, often listing victims on its onion-site blog after exfiltration. Its typical playbook involves initial access through phishing or exploited remote desktop services, followed by data theft, encryption of systems, and dual extortion: demanding payment to decrypt files and a second sum to prevent publication of the stolen documents. Notable prior victims include companies in manufacturing, logistics, and professional services, though exact details vary by incident.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity so you can see exactly what this claimed breach exposes about you and your family.
• Rotate the password you used at any LiftPRO-related vendor portal anywhere it is reused, and switch on 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and emails used for adult vendor relationships.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing accounts and alerting family members.

The LiftPRO incident is a reminder that industrial suppliers, not just banks or retailers, can become gateways to your personal data. Acting quickly on exposed credentials and mapping your full identity chain gives you the best chance of stopping the next stage of an attack before it reaches your family. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for you and your entire household, including children’s gaming accounts that are frequently targeted once a family link is established.