AIRCOS Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The listing of AIRCOS by the ransomware group thegentlemen indicates that internal files were removed from the company’s systems during a ransomware incident. Because the number of individuals whose information may be involved remains unknown, the practical consequence for employees, business partners, and customers is that personal or operational details could now circulate without their knowledge or consent.

The incident was reported on 4 April 2026. At present, no confirmation exists on the volume of data taken or whether the files have been published.

Inside the incident

Public records show only that AIRCOS was listed by thegentlemen and that internal files were allegedly exfiltrated during a ransomware attack. No further details on the date of intrusion, the method of entry, the quantity of data removed, or any ransom demand have been disclosed. The organisation has not issued a public statement confirming or denying the claims.

Who is thegentlemen?

Thegentlemen is a ransomware group that maintains a leak site where it lists organisations it claims to have compromised. Such groups typically encrypt systems and threaten to release stolen files if a ransom is not paid. The listing of AIRCOS constitutes the group’s claim; independent verification of the underlying events has not been published.

AIRCOS and its sector

AIRCOS, operating as Aircos Pascual, is a French industrial cosmetics manufacturer and member of the ANJAC Group. The company develops hybrid makeup technologies, including loose powders, hot-cast formulas, lip fluids, and foundation fluids. It maintains three production sites in France, employs approximately 300 people including 25 research-and-development specialists, and holds around 450 active formulas. Its clients are primarily other beauty brands that rely on the firm for product formulation and manufacturing.

Organisations in this sector routinely manage technical specifications, supplier contracts, employee records, and formulation data. A breach affecting such a company can expose proprietary processes as well as information about individuals connected to its operations.

What data was at risk

The only detail released states that internal files were exfiltrated. The precise categories of information contained in those files have not been disclosed. Companies of this type commonly store employee records, customer and supplier contact details, financial documents, and research-and-development materials; however, whether any of these specific types were taken remains unconfirmed.

The real-world impact

Individuals whose details appear in the exfiltrated files may face increased risk of targeted phishing or identity misuse if the material is later published or sold. For the organisation, the exposure of formulation data or commercial agreements could affect competitive standing and contractual relationships. No evidence has been made public that the files have been used in any further criminal activity.

What to do if you're exposed

Anyone who has worked with or for AIRCOS, or who has shared personal information with the company, should monitor their email and financial accounts for unusual activity. Enabling multi-factor authentication on important services and using unique passwords reduces the chance that exposed credentials can be reused. Readers can run a free exposure scan of their email address to check whether their information has appeared in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.