While DragonForce did not disclose the nature of the incident, it provided a small sample of allegedly stolen data, which included confidential documentation, contract information, an incident report, and more.

Cyber Daily understands that the QLS incident was an internal one, which was resolved at the time of discovery, and the firm has no ongoing concerns.

Who is DragonForce?

DragonForce runs a ransomware-as-a-service operation in which affiliates can hire the gang’s ransomware platform in return for a cut of any profits. The gang passes on up to 80 per cent of ransom payments and commonly advertises its services on Russian-language hacking forums. To date, the threat group has 558 victims.

The group is believed to have links to the LockBit ransomware operation and engages in double-extortion tactics. It has claimed 505 victims to date, over double what it had in just September last year.

Last year, the group claimed an incident on Queensland-based Toowoomba Friendlies Society Dispensary, claiming to have stolen 35.82 gigabytes of data, including financial documents, counterparties and clients.

The data that was freely available on the darknet includes highly sensitive medical documents featuring the names, addresses, and – in some cases – photographs of patients, as well as the treatment/s they have been receiving, from methadone treatment to prescriptions of emergency contraceptives.

Vaccination lists, details of staff pay, and scans of employees’ Medicare cards and driver’s licenses have also been shared by the hackers.