Gelatissimo Hit by DragonForce Ransomware Attack, 352GB of Data Allegedly Stolen Australia’s largest gelato retailer, Gelatissimo, has been listed on the dark web leak site of the DragonForce ransomware gang, which claims to have exfiltrated 352.24GB of sensitive data in the breach. The company, operating over 50 locations in Australia and several overseas including six outlets in the Philippines has yet to publicly respond to the incident. DragonForce posted a sample of the stolen data, including six screenshots of internal documents. The exposed files contain employee and executive details, such as names, income types, partial tax file numbers, emails, phone numbers, and roles. Additional leaked documents include a financial receipt with account details, an incident report, a bank statement, and a visa application form with extensive personal data. The threat group has threatened to publish the full dataset in just over four days from the time of the leak’s announcement. ### About DragonForce DragonForce operates as a ransomware-as-a-service (RaaS) group, offering its malware to affiliates in exchange for a 80% cut of ransom payments. The gang, which has claimed 505 victims to date more than double its count from September 2023 is believed to have ties to the LockBit ransomware operation and employs double-extortion tactics. In a 2023 attack on Queensland’s Toowoomba Friendlies Society Dispensary, DragonForce leaked 35.82GB of data, including highly sensitive medical records such as patient names, addresses, treatment details (including methadone prescriptions), vaccination lists, staff payroll information, and scans of Medicare cards and driver’s licenses.