Cosmesia Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 09, 2026, the ransomware group thegentlemen listed Cosmesia on its leak site, stating that internal files had been exfiltrated during an attack. The number of people affected remains unknown, and no further details on the scale or timing of the incident have been disclosed publicly. Such listings have become a recurring feature of the current threat landscape, where ransomware operators combine encryption with data theft to pressure targeted organisations.

What happened

The incident centres on a claim posted by thegentlemen that it had carried out a ransomware operation against Cosmesia and removed internal files. The listing appeared on March 09, 2026. No independent confirmation of the claim or additional technical details have been made public. The number of individuals whose information may be involved is not stated.

Who is thegentlemen?

Thegentlemen is a ransomware group that maintains a leak site to publish names of organisations it claims to have targeted. Groups of this type typically combine file encryption with the threat of data release. The listing of Cosmesia constitutes the group’s own claim; no separate verification of the underlying activity has been reported.

Who is Cosmesia?

Cosmesia is associated with Nutrition Profess Public Company Limited, a producer of dietary supplements and cosmetics manufactured under customer brands. The organisation focuses on product development, quality planning and client consultation within the health and wellness sector. Companies in this field routinely process formulation records, supplier agreements, regulatory documentation and customer-related information.

The information in question

The only data category named in the listing is internal files exfiltrated during the ransomware attack. The precise contents of those files have not been disclosed. Organisations of this type commonly hold records relating to product development, manufacturing processes and business operations, yet the exact nature of the material removed remains unconfirmed.

What's at stake

Exposure of internal files can reveal operational details that competitors or regulators may examine. For individuals whose information appears in such records, the primary concerns are potential misuse of contact details or commercial data. The organisation faces possible regulatory scrutiny and the need to review its data-handling practices.

Were you affected?

Individuals can take the following initial steps if they have interacted with Cosmesia or similar companies:

• Monitor email accounts for unusual activity and enable multi-factor authentication where available.
• Review privacy settings on accounts that may share data with supplement or cosmetics suppliers.
• Run a free exposure scan of their email address against known breach data to check for prior appearances.

Further official guidance from the company or regulators may be issued as more information becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.