The thegentlemen ransomware group listed *****.com on its data leak site on 2025-12-12. Sector: Retail & E-Commerce Domains named: i2ohjeeqe37jre4f2u7pyq73cbm6lecumdxapkvrlryna6rc3it4zsid.onion Claim as published on the leak site: The entire infrastructure of a major regional retail grocery network—comprising approximately 80 grocery stores, about 40 liquor outlets, and roughly 50 pharmacies, along with its franchise operations—has been compromised, with all data stolen and encrypted. The targeted company reports an annual revenue of $1.4 to $1.8 billion (according to various 2025 estimates). The exfiltrated data includes all insurance payouts (even detailed records of payouts to families of deceased employees, listing cause of death and amounts paid), complete personnel records for all employees and executives (containing SSN, date of birth, full name, address, passport details, and W-9 forms), every financial document, records of active deals and income/expenses, as well as all documentation and insurance records for the company's movable and immovable property. http://i2ohjeeqe37jre4f2u7pyq73cbm6lecumdxapkvrlryna6rc3it4zsid.onion (your key in Tox Chat)
OffSet7 / Dark Web / thegentlemen
*****.com listed by thegentlemen ransomware group
- Group
- thegentlemen
- Sector
- Retail & E-Commerce
- First seen
- 12 December 2025
This is a claim published by the threat group itself and has not been independently verified. OffSet7 does not host or link to any leaked data.
Monitor your company and suppliers
Get an alert the moment a ransomware group names your company or one of your suppliers.