Extortion Group DragonForce Demands $5 Million From Hisense Following Data Theft Claim

The extortion group known as DragonForce has claimed responsibility for a cyberattack on the Chinese electronics multinational Hisense, asserting that it has exfiltrated 19GB of sensitive data from the company’s systems.

The threat actors have reportedly set a ransom demand of $5 million (approximately £3.8 million) to prevent the publication of the stolen files. The group listed Hisense on its dark web leak site, providing what it claims are samples of the internal data to substantiate the breach.

Details of the Alleged Intrusion

According to the claims made by the group, the 19GB dataset includes internal corporate documents and potentially sensitive business information. While the exact scope of the data remains unverified, the threat of publication is a standard tactic used by extortion-focused groups to pressure large organisations into rapid payment.

DragonForce is a relatively recent entrant to the cyber-extortion landscape. The group typically operates by gaining unauthorised access to corporate networks and stealing data rather than relying solely on file encryption. This “data-theft-only” or “double extortion” model allows attackers to maintain leverage even if the victim organisation can restore its systems from backups.

Impact and Response

Hisense, a major global manufacturer of smart TVs, household appliances, and mobile communication devices, has not yet released a formal public statement regarding the extortion threat or the validity of the data theft. If confirmed, the breach could pose risks to the company’s intellectual property and internal operational security.

The incident highlights a continuing trend where cyber-criminal organisations target high-profile consumer electronics firms to extract high-value ransoms. In such cases, the primary risk often extends to employees and business partners whose contact details or contractual information may be contained within the stolen archives.

Security researchers suggest that organisations facing such threats should focus on incident response protocols, including identifying the point of entry and securing affected accounts. Users and employees associated with Hisense are advised to remain vigilant against potential phishing attempts that may utilise leaked information to increase their perceived legitimacy.

The deadline for the ransom payment has reportedly been set, after which the group threatens to make the full 19GB archive available for download on their leak platform. Privacy Needle will continue to monitor the situation for updates on Hisense’s response and any further verification of the data involved.