Cofaq Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 20, 2026, the ransomware group thegentlemen listed Cofaq on its site, stating that internal files had been taken during an attack. The number of individuals affected is not known, and no further details on the timing, method, or volume of data have been made public. This listing raises questions for the cooperative’s members, suppliers, and staff whose records may be involved, as well as for the hundreds of independent retailers that rely on the organisation’s shared services.

Inside the incident

Public information about the event remains limited to the group’s listing. The entry describes the exfiltration of internal files in a ransomware operation, but provides no confirmed count of records, no timeline of access, and no indication whether data has been published or used elsewhere. No statement from Cofaq confirming or disputing the claim has been referenced in available reports.

The group behind it: thegentlemen

Thegentlemen is a ransomware operator that has appeared in multiple public listings of victim organisations. Its typical pattern involves claiming data theft and posting victim names on a leak site to pressure payment. The listing of Cofaq follows this established approach, though the group’s specific assertions about this case have not been independently verified beyond the site entry itself.

Who is Cofaq?

Groupe COFAQ is a French cooperative headquartered in Poitiers that brings together independent distributors of hardware, tools, industrial supplies, and agricultural equipment. It supports several hundred retail outlets across France through centralised purchasing and logistics platforms such as COFALOG. The structure allows smaller merchants to pool resources for supply-chain and commercial operations.

What data was at risk

The only detail released is that internal files were taken. The exact categories of information contained in those files have not been disclosed. Organisations of this type commonly hold supplier contracts, member account records, inventory data, and internal communications; however, whether any of these specific categories were accessed remains unconfirmed.

Why it matters

Exposure of internal files from a cooperative can affect both the central organisation and its affiliated retailers, potentially revealing operational details that are normally kept within the network. For individuals whose information appears in those files, the primary concern is the unknown scope of any personal or business records that may now circulate outside controlled systems.

If your data was in this claimed breach

Monitor accounts linked to any Cofaq-related services for unusual activity and consider changing passwords where reuse may have occurred. A free exposure scan of your email address against known breach data can indicate whether your information has appeared in previously published sets.

AICompiled with AI assistance from public sources and published under our editorial standards.