DermaPharm Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
DermaPharm was listed by thegentlemen ransomware group on 09 May 2026 after internal files were exfiltrated in a ransomware attack; the number of people affected and the exact date of the intrusion have not been established. Individuals who may have had data held by DermaPharm should check the company’s notifications and consider protective steps such as monitoring accounts and changing passwords.
Breaking down the breach
The only confirmed detail is the group’s claim that it targeted dermapharm.dk and removed internal files during a ransomware operation. No independent confirmation of the volume of data, the encryption of systems, or any ransom demand has been made public. The date the files were taken, the duration of any unauthorised access, and whether the data has been published or sold are all undisclosed.
The group behind it: thegentlemen
Thegentlemen is a ransomware operator that maintains a leak site to list organisations it claims to have compromised. Groups of this type commonly combine file encryption with data exfiltration, then pressure victims by threatening to release stolen material. The listing of DermaPharm constitutes the group’s assertion of responsibility; no additional statements or evidence specific to this incident have been verified beyond that claim.
About DermaPharm
DermaPharm A/S is a privately owned Danish company established in 1980 and based in Fårup. It produces mild, eco-certified and allergy-friendly personal-care items under its own Derma brand and manufactures private-label products for other companies. The firm operates a 10,000-square-metre production site and holds a leading position in Nordic suncare products while maintaining a partnership with the Danish Cancer Society.
What data was at risk
The only information released states that internal files were exfiltrated. The exact categories of data contained in those files have not been published. Companies in this sector routinely hold customer records, supplier contracts, formulation details, employee information and regulatory documentation; whether any of these types were among the files taken remains unconfirmed.
Why it matters
Exposure of internal files can reveal proprietary processes, commercial relationships and personal data of employees or customers. For individuals, the primary concern is the potential misuse of any personal information that may have been included. For the company, the incident adds operational disruption and the need to assess downstream effects on partners and regulatory compliance.
Were you affected?
Individuals who have interacted with DermaPharm or its private-label clients have no confirmed public list against which to check. A practical first step is to monitor official statements from the company and to review any accounts linked to the organisation for unusual activity. Readers may also run a free exposure scan of their email address against known breach data sets to identify whether their information appears in previously published incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Medic Rescue Listed by thegentlemen Ransomware GroupNatren Listed by thegentlemen Ransomware GroupErgoMed Listed by thegentlemen Ransomware GroupCentre Ophtalmologique dErmont Listed by thegentlemen Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the DermaPharm Listed by thegentlemen Ransomware Group →
Publicly posted by thegentlemen — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.