Mobilelink USA Listed by dragonforce Ransomware Group

On December 2, 2025, Mobilelink USA appeared on the leak site of the dragonforce ransomware group after the company’s internal files were allegedly exfiltrated during a ransomware attack. The breach affects anyone who has ever purchased a Cricket Wireless phone, signed up for 5G LTE service, or provided personal information to one of the retailer’s stores, because customer records were among the data taken.

What's Publicly Reported from Reporting

Public reporting indicates that dragonforce posted proof of the compromise on its leak site, showing samples of exfiltrated internal files. Mobilelink USA is the largest exclusive retailer for Cricket Wireless and operates hundreds of locations across the United States. The exact number of people whose records were taken remains unknown, but the nature of a retail wireless provider means names, addresses, phone numbers, email addresses, account details, and payment information are likely included. No evidence has surfaced that customer credit-card numbers were encrypted or that the company paid the ransom. The listing carries the typical dragonforce deadline pressure, although the precise date has not been independently verified beyond the leak-site posting.

Why This Matters for You and Your Family

Wireless retailers hold the same sensitive data as major carriers: your full name, physical address, date of birth, Social Security number (for credit checks), driver’s license scan, and every phone number tied to your household. Once that information leaves the company’s control, it can be sold quietly on criminal forums or used to open new accounts in your name. If you or your children have ever activated a Cricket line through a Mobilelink store, your family’s data is now in play. The breach also increases the chance that login credentials reused from other services could be matched to your Mobilelink profile, turning one leak into multiple account takeovers.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at the first dataset. The files allegedly taken from Mobilelink can be cross-referenced with other breaches to build detailed profiles that link your email, phone, gaming usernames, and family members’ accounts. A child’s Roblox or Fortnite handle connected to a parent’s Mobilelink email creates a direct path for harassment, SIM-swapping, or targeted extortion. Available reporting describes these identity chains as the fastest-growing risk after retail breaches, because one exposed address or phone number can expose every linked online account within hours.

Dragonforce’s Publicly Known Track Record

Public reporting attributes the group’s emergence to mid-2024. Dragonforce has listed dozens of organizations ranging from regional hospitals to retail chains. Its typical playbook begins with initial access through phishing or exploited remote-desktop tools, followed by rapid exfiltration of internal file shares, then dual extortion: threatening to publish the data while simultaneously encrypting systems. The group posts samples on its leak site and sets short payment deadlines, often measured in days. Exact success rates are difficult to confirm, but the volume of victims listed suggests the tactic frequently pressures companies into negotiation or forces them to notify customers after the fact.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what the Mobilelink data connects to.
• Rotate the password used at Mobilelink anywhere it is reused and switch on 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests for any data-broker listings that surface from this claimed breach.

The Mobilelink USA incident shows how quickly a routine retail purchase can feed a larger doxxing chain. Taking deliberate steps now limits how far criminals can travel with your information. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for you and your entire household, including children’s gaming accounts that are frequently targeted after credential leaks like this one.