Brookview Financial Data Breach

Brookview Financial, a Canadian financial services company operating under brookviewfinancial[.]com, was listed on DragonForce’s leak site on August 24, 2026. Financial services organizations possess sensitive client data and incur significant operational downtime costs, which enhances their extortion leverage and makes them a consistent target for ransomware attacks. DragonForce claimed 48 victims in the 60 days preceding this listing, primarily targeting the Business Services and Manufacturing sectors in the United States, UK, and China. While Canada has appeared within DragonForce’s target footprint, the group has shown consistent interest in North American financial organizations. Comparable victims in financial and geographic contexts include GB Group S.A, Petrini Valores, Wozair, and Criba.

SOCRadar’s stealer-log telemetry returned no records for brookviewfinancial[.]com within the queried dataset. It is important to note that this dataset represents a paginated sample and may not reflect all active log feeds, alternate domains used by the firm’s advisors, or credentials harvested under personal or affiliated email aliases. Financial services firms often operate under multiple branded domains that would not appear in a single-domain query. DragonForce’s access chain typically involves Initial Access Brokers (IABs) sourcing infostealer logs from underground markets, validating corporate credentials, and authenticating against platforms like Microsoft 365, VPNs, or remote-access portals. For a financial services firm, the relevant credential surface includes advisor portals, client account management systems, and any third-party financial platform integrations. Each of these presents potential credential exposure that may not surface in a primary-domain stealer-log query. Given DragonForce’s pace of 48 victims in 60 days and its documented targeting of North American financial entities, prioritizing credential hygiene for client-facing systems is advisable.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.