Cleor Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Cleor, a French jewelry retailer, was listed by the ransomware group thegentlemen on April 14, 2026. The listing states that internal files were exfiltrated during a ransomware attack. The number of people affected remains unknown, and no further details on the volume or contents of the data have been made public. This incident matters because Cleor holds customer records and operational information tied to sales of high-value items. Even without confirmed personal data exposure, the presence of internal files on a leak site can create downstream risks for individuals and the business.

Inside the incident

The only confirmed information is the April 14, 2026 listing by thegentlemen and the statement that internal files were taken. No ransom demand amount, encryption details, or confirmation of data publication has been disclosed. The scale of the operation and the method of initial access are not publicly reported.

The group behind it: thegentlemen

Thegentlemen is a ransomware operator that maintains a leak site to list organizations it claims to have targeted. Such groups typically gain access through phishing, stolen credentials, or unpatched systems, then exfiltrate data before deploying encryption. The listing of Cleor constitutes the group’s claim; independent verification of the data or the attack has not been provided in public reporting.

Cleor and its sector

Cleor is a French jewelry brand established for more than twenty years. It designs, sources, and sells jewelry, watches, and accessories through its website and physical stores in France, controlling the supply chain from raw materials to finished goods. Jewelry retailers routinely process customer names, addresses, payment details, and order histories, along with supplier contracts and internal design documents.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific file types or data categories has been released. Organizations in this sector commonly store customer account information, transaction records, and proprietary product data, yet the precise contents of the exfiltrated material remain unconfirmed.

The real-world impact

Exposed internal files can contain customer contact details or payment references that enable targeted fraud or phishing. For the company, the incident may lead to regulatory scrutiny under French and European data-protection rules and to costs associated with investigation and system restoration. Individuals cannot yet assess their personal exposure because the affected population and data categories are not known.

Were you affected?

Because the number of individuals involved is undisclosed, anyone who has purchased from Cleor or provided personal information to the company should treat the possibility of exposure as open. Practical first steps include monitoring bank and credit-card statements for unusual activity, enabling multi-factor authentication on any accounts that may share the same credentials, and requesting a copy of personal data held by the retailer under applicable privacy regulations.

• Review recent statements from payment cards used with Cleor.
• Change passwords for any accounts that reuse credentials supplied to the company.
• Run a free exposure scan of your email address against known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.