McCOR Listed by dragonforce Ransomware Group

On April 15, 2026, Canadian real estate and property management firm McCor appeared on the leak site of the dragonforce ransomware group. Internal files were allegedly exfiltrated during a ransomware attack, and the company’s data is now publicly listed for anyone to access.

What's Publicly Reported from Reporting

Public reporting indicates that dragonforce added McCor to its leak site on April 15, 2026. The posting states that internal files were stolen before encryption occurred. No exact number of affected individuals has been disclosed, but the breach involves data from a firm that manages commercial, retail, and residential properties across Canada. Available reporting describes the exposed material as internal company files rather than a specific list of customer records, though such documents frequently contain tenant names, contact details, financial information, and lease agreements.

McCor provides investment management, leasing, project management, and advisory services to real estate developers and tenants. Any records taken could therefore include personal information belonging to landlords, tenants, vendors, and employees.

Why This Matters for You and Your Family

When a property management company loses control of internal files, the people whose information sits in those files are placed at immediate risk. If you rent or own property managed by McCor, your name, address, phone number, email, bank details, or lease documents may now be in the hands of criminals. The same applies if you have ever done business with one of their clients.

Stolen personal data rarely stays isolated. Criminals combine it with other leaks to build complete profiles. Once they know where you live, what you earn, and who you do business with, they can target you or your family with phishing emails, fake tenant demands, or identity theft. Children’s information linked to family leases can also surface, increasing the chance that gaming accounts or school-related records become part of larger doxxing campaigns.

The Doxxing and Identity-Chain Implications

A single breach like this rarely stops at the initial leak. Attackers map connections between email addresses, phone numbers, usernames, and real-world identities. One exposed lease document can reveal your home address, which then links to your children’s online gaming accounts or family social-media profiles. This creates an identity chain that lets criminals move from property records to doxxing, account takeovers, or extortion attempts.

Credential leaks from property management systems often cascade into gaming platforms because families reuse passwords. A teenager’s Roblox or Fortnite account tied to a parent’s breached email can be hijacked within hours, leading to further harassment or demands for ransom.

Dragonforce’s Publicly Known Track Record

Public reporting attributes the attack to the dragonforce ransomware group. The group emerged in late 2024 and has quickly built a reputation for aggressive double-extortion tactics. Notable prior victims include mid-sized companies across North America and Europe in sectors ranging from manufacturing to professional services. Their typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by rapid exfiltration of sensitive files. They then demand payment to prevent publication, using leak sites to apply public pressure. Reporting describes their extortion style as opportunistic, often listing victims within days of gaining access and threatening to release data in batches if deadlines are missed.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what the McCor breach connects to.
• Rotate any password you used on McCor systems or related property portals anywhere it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The McCor incident shows how quickly business data becomes personal risk. Acting promptly limits how far criminals can travel down the identity chain that now includes your information. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting protective measures now reduces the chance that this claimed breach becomes the first link in a longer campaign against you and your family.