Antigo Construction
bd_951ce8deaeedc418 · schema v1 · pii pii-v1
Full breach record for Antigo Construction →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group DragonForce on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
(including email) Antigo Construction is located in Antigo, Wisconsin, and is the company headquarters for the North American and international business operations. Antigo entered the pavement rehabilitation business in 1982 when it imported from Germany the first of six guillotine-style concrete pavement breakers. In 1988 Antigo began operating the 8600 Badger Breaker® and in 1995 introduced the MHB Badger Breaker® to respond to the growing demand for more efficient and effective concrete breaking technology. Today Antigo is the worldwide leader in concrete pavement rehabilitation: concrete rubblization - 45 million square yards (38m m2), crack/break and seat - 82 million square yards (69m m2), break for removal - 106 million square yards (88m m2). Antigo has the equipment, people and experience to get the job done right.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Jun 26, 2025
Claim posted
—
Corroborated · see linked filings
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- Montana State AGbd_a20723f7a3265c322025-10-31 · +126dCandidate
- Indiana State AGbd_f26ce1151d0571002025-10-31 · +126dVerified
Filing propagation · 3 filings · 2 states
View merged incident ↗Pattern: first filing Jun 26, last Oct 31 (IN) — a 126-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
dragonforce
According to ransomware.live, DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.