Dolidol Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target manufacturers and mid-sized industrial firms across regions, using leak-site listings to pressure victims after claiming to have stolen internal data. In this environment, even companies outside the usual technology or finance sectors can find themselves named on criminal forums, with limited public detail available about what actually occurred.

On 9 September 2025, the Moroccan mattress and foam manufacturer Dolidol was listed by the ransomware group known as thegentlemen. Public reporting indicates the group claims to have exfiltrated internal files during a ransomware attack. The number of people affected remains unknown, and further technical specifics have not been disclosed.

What happened

According to available records, Dolidol was named on a leak site associated with thegentlemen ransomware group on 9 September 2025. The listing asserts that internal files were exfiltrated as part of a ransomware attack. No confirmed figures for the volume of data, the precise date of intrusion, or the initial access method have been made public. The number of individuals whose information may be involved is listed as unknown. At the time of reporting, the claim rests on the group's own publication rather than independent verification by the company or authorities.

Inside thegentlemen

thegentlemen is a ransomware operation that has appeared in public threat reporting as a group employing double-extortion tactics: encrypting systems while also claiming to steal data and threatening to publish it if payment is not made. Like many contemporary ransomware crews, it maintains a leak site on which it posts victim names and, in some cases, samples of purportedly stolen material. Public knowledge of the group centres on this pattern of activity rather than on any unique technical signature disclosed in connection with Dolidol. In this instance, the listing of Dolidol should be treated as an unverified claim by the group; no independent confirmation of the breach or of specific data samples has been included in the available facts.

About Dolidol

Dolidol is a long-established Moroccan manufacturer of polyurethane foam, mattresses, sofas and non-woven textiles. Founded in 1972, it is described as one of the older mattress producers in the country and is positioned as a higher-end brand with a broad domestic distribution network that includes 46 owned stores, 10 distribution facilities and more than 1,100 distributors. Companies of this type typically maintain records covering production, supply-chain partners, retail operations, employee information and customer or distributor contacts. A breach affecting such an organisation can therefore touch both commercial operations and personal data held in the ordinary course of manufacturing and retail activity across Morocco.

What was likely exposed

The only data category named in public reporting is “internal files exfiltrated in ransomware attack.” No further breakdown of file types, volumes or categories has been disclosed. Organisations in the manufacturing and retail sector commonly hold employee records, supplier contracts, production data, distributor lists and customer-related information. Because the exact contents remain unconfirmed, it is not possible to state with certainty which of these, if any, were taken. Readers should treat any more specific claims circulating online as unverified unless corroborated by the company or official sources.

Why it matters

For individuals whose details may appear in internal files, the practical risks include unwanted contact, phishing attempts that reference genuine company relationships, or the misuse of personal identifiers if such data were present. For Dolidol itself, the listing creates operational and reputational pressure: production and distribution networks depend on trust among employees, distributors and retail partners, and any disruption or loss of confidence can affect day-to-day business. Because the scale of the incident is unknown, both the company and potentially affected people face uncertainty about the precise scope of exposure. In the wider landscape, the episode illustrates how ransomware groups continue to select industrial and consumer-goods firms whose data may hold commercial or personal value, regardless of the sector’s traditional cyber profile.

If your data was in this claimed breach

If you have a past or present connection with Dolidol as an employee, distributor, supplier or customer, consider these measured first steps:

• Monitor financial and email accounts for unexpected activity or messages that reference the company.
• Treat unsolicited requests for personal or payment information with caution, even if they appear to come from a familiar business contact.
• Update passwords on any accounts that may have used the same credentials associated with Dolidol systems, and enable multi-factor authentication where available.
• Retain records of any unusual communications so they can be reported to the company or local authorities if needed.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Public detail on this incident remains limited; any further official statements from Dolidol or Moroccan authorities should be regarded as the authoritative source for next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.