Ransomware victim disclosure
← All victimsCF Evans Construction
Claimed by Dragonforce · listed 12 days ago
Status timeline
- Listed
May 9, 2026
Current state: Listed for ransom
At a glance
- Group
- Dragonforce
- Status
- Listed for ransom
- Country
- United States
- Sector
- Construction
- Listed on leak site
- May 9, 2026
- Data size
- 4775795351552
- Ransom demanded
- $4
About the victim
AI dossier — public-source company profileCF Evans Construction is a multifamily housing general contractor headquartered in Orangeburg, South Carolina, with over 75 years of operation. The company serves developers and investors across the Southeast United States, building apartment communities, workforce housing, and active-living developments. It is described as a premier multifamily construction firm with a portfolio spanning multiple states including South Carolina and North Carolina.
- Industry
- Multifamily Residential Construction
- Address
- 125 Regional Pkwy Ste 200, Orangeburg, South Carolina, 29118, United States
Attack summary
Severity: high — Confirmed exfiltration of ~4.78 TB of significant business data including financial records, HR documents, executive correspondence, contracts, passwords, and databases. The inclusion of passwords and HR data elevates risk; however, no explicit large-scale regulated PII (e.g., medical or government) is stated, keeping it at high rather than critical.Dragonforce claims to have exfiltrated approximately 4.78 TB of data from CF Evans Construction, including corporate executive correspondence, financial documents, HR and accounting records, certificates, contracts, passwords, and databases. The post sets a publication timer deadline of 2026-05-22, implying threatened public release if demands are not met.
Data the group says was taken
AI dossier — extracted from the leak post- Corporate correspondence of senior executives
- Financial documents
- HR documents
- Accounting documents
- Certificates
- Contracts
- Passwords
- Databases
What the group claims
A recognized leader in the multi-family housing construction industry, CF Evans Construction provides a product for developers. The company has thrived amid six decades.
The leak post
captured from the group's site```
{"data":{"count":483,"publications":[{"uuid":"b008b8b7-0e47-416f-adcd-2313d8136de4","created_at":"2026-05-08T20:56:13.122134Z","name":"CF Evans Construction","website":"www.cfevans.com","address":"125 Regional Pkwy Ste 200, Orangeburg, South Carolina, 29118, United States","description":"A recognized leader in the multi-family housing construction industry, CF Evans Construction provides a product for developers. The company has thrived amid six decades.\nThe data of this company includes:\n Corporate correspondence of senior executives\n Financial documents\n HR documents\n Accounting documents\n Certificates, contracts, passwords, databases, and much more.","weight":4775795351552,"is_timer_publication_stopped":false,"timer_publication":"2026-05-22T07:48:00Z","try_again":false,"tags":[],"logo_uuid":"f4e582dd-6562-4590-bac8-2b9e5c564853","is_transfering":false},{"uuid":"3827192f-9bb3-490c-9c1c-d28b382510cd","created_at":"2026-05-08T17:53:24.736605Z","name":"CMC Expertise Comptable","website":"cmcexpertise.fr","address":"32 Rue De La Clairière, Fort-de-France,","description":"CMC Expertise Comptable is a certified accounting firm located in Martinique, dedicated t…Data the group says was taken
- Corporate correspondence of senior executives
- Financial documents
- HR documents
- Accounting documents
- Certificates
- contracts
- passwords
- databases
Sources
Source
Indexed 12 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
