Ransomware gang gives Strafford County NH 5 days to pay ransom before 830 GB of data leaked

This morning, ransomware gang DragonForce uploaded Strafford County, NH, to its data leak site, giving the US government entity just five days to meet its ransom demands before 830.03 GB of data is leaked.

Strafford County noted network disruptions in the middle of March 2025 before bringing 98% of its systems back online around 10 days later. Strafford County Commissioner Chair George Maglaras stated:

Strafford County recently experienced a security incident which caused a network interruption impacting systems operations. Our primary focus remains on the continuation of essential services, a safe and efficient remediation process, the protection of the data we maintain, and the restoration of our systems. While our investigation is in its early stages, and is ongoing, some of our systems will remain offline in order to ensure we can be brought back to full operational capacity as quickly and safely as possible.”

Despite having to resort to pen and paper, medical operations and records remained functional at Riverside Rest Home and the sheriff’s department wasn’t affected as it runs on a separate system.

Strafford County hasn’t provided any further updates on the nature of this attack and hasn’t confirmed DragonForce’s claim. Comparitech has contacted the county for further information and will update this article if we receive a response. In the meantime, Strafford County residents and employees should remain on high alert for any phishing messages (via phone, email, or text) and monitor accounts for any suspicious activity.

Who is DragonForce?

DragonForce gained notoriety this year after it attacked three UK retailers–Marks & Spencer, Co-op, and Harrods. Its attack on Marks & Spencer was particularly disruptive and is expected to cost the company around $400 million.

So far this year, DragonForce has claimed 66 attacks with eight of these being confirmed by the entity involved. As well as those mentioned above, the following have also suffered attacks:

• Accelerator AS – The Norweigan transport company fell victim to DragonForce on January 20 but was able to get its systems back up and running the following day.
• Jan Nygaard AS – Also able to stop the hackers in their tracks was Jan Nygaard, a Danish retail company. Systems were restored on the same day as the attack in January.
• Vercoe Insurance Brokers – After being added to DragonForce’s data leak site in March 2025, the New Zealand insurance company confirmed it had suffered an attack.
• City of Grove – Also hit in March 2025 was the City of Grove, OK. 78.92 GB of data was allegedly stolen in this attack.

Other DragonForce victims from previous years are still being confirmed, too, with one of the latest being IT services firm, GeoLogics Corporation. At the end of May 2025, it began notifying nearly 12,000 of a breach that stemmed from a cyber attack way back in December 2023. Here, DragonForce alleged to have stolen nearly 123 GB of data.

DragonForce operates a ransomware-as-a-service business whereby affiliates use its malware to encrypt systems and take a percentage of the ransom payments in return. Like most gangs today, DragonForce employs a double-extortion tactic where it demands two ransoms: one to decrypt systems and another to delete stolen data.

Ransomware attacks on US government agencies

Throughout 2025, we’ve tracked 30 confirmed attacks on US government entities and are monitoring a further 31 unconfirmed.

So far this month, the City of Durant has confirmed an attack (no hackers have claimed as of yet), while Payne County Sheriff’s Office and Liberty Township were both hit by attacks in May 2025. Both of these were claimed by SafePay.

In the case of Payne County Sheriff’s Office, critical services weren’t affected but people were warned of a data breach following SafePay’s claim that is had stolen 8 GB of data.

Over the weekend, SafePay claimed the attack on Liberty Township, alleging that it had stolen 48 GB of data. Liberty Township confirmed it had suffered a ransomware attack on May 5 with investigations ongoing a month later.

Other recently confirmed attacks include:

About Strafford County, NH

Strafford County in New Hampshire has a population of over 125,000 people and is comprised of three cities (Dover, Rochester, and Somersworth) and 10 towns (Barrington, Durham, Farmington, Lee, Madbury, Middleton, Milton, New Durham, Rollinsford, and Strafford).