Donacoop (VinaCapital) Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a company that develops real estate, infrastructure and large urban projects is listed by a ransomware group, the practical concern for ordinary people is straightforward: internal files may have left the organisation’s control. Those files can contain personal details of employees, partners, contractors or residents connected to projects. Public reporting so far does not confirm how many people are affected or exactly what records were taken, yet the listing itself means the risk of exposure cannot be dismissed.

On 19 February 2025 the ransomware group known as thegentlemen claimed Donacoop (VinaCapital) on its leak site, stating that internal files had been exfiltrated. The number of people affected remains unknown and further technical detail has not been released. For anyone who has worked with, invested alongside or lived near projects linked to the firm, the immediate question is whether their own information is among the material the group says it holds.

Inside the incident

According to the public listing, Donacoop (VinaCapital) was named by thegentlemen ransomware group on 19 February 2025. The group states that internal files were exfiltrated during a ransomware attack. No confirmed figure for the number of people affected has been published, nor have the precise dates of intrusion, encryption or data transfer been disclosed. The method of initial access, the volume of data claimed, and any ransom demand remain unconfirmed in available reporting. The incident is therefore known primarily through the group’s own claim rather than through independent verification or an official statement detailing the breach.

Public detail is limited to the assertion that internal files left the organisation. Whether those files have been published, sold or retained solely for leverage is not stated in the facts available. Organisations facing such claims typically investigate the scope of access and notify regulators or affected parties once the facts are clearer; no such notifications are recorded in the material provided here.

Inside thegentlemen

thegentlemen is a ransomware operation that has appeared in public reporting as a double-extortion group: it encrypts systems and simultaneously claims to have stolen data, then threatens to release the data if a ransom is not paid. Like other groups of this type, it maintains a leak site where it lists victims and, in some cases, posts samples or full archives. Its listings are claims made by the actors themselves and are not independently verified at the moment they appear.

Publicly documented activity associated with the group includes targeting organisations across multiple sectors and geographies, often focusing on entities whose data would create pressure if released. The group’s typical tactics, drawn from open reporting on its operations, involve initial access followed by lateral movement, data staging and exfiltration before encryption. Specific claims the group has made about Donacoop (VinaCapital) beyond the listing itself and the assertion of internal-file exfiltration are not detailed in the available facts; any further statements on its site should be treated as unverified assertions by the threat actors.

Who is Donacoop (VinaCapital)?

Donacoop is described as a major Vietnamese conglomerate based in Dong Nai province. It evolved from agricultural and handicraft cooperatives into large-scale real estate and infrastructure development. It acts as a key investor in metro-line extension projects with VinaCapital and develops major projects such as Dong Nai Waterfront City in partnership with Keppel Land. The organisation also participates in philanthropic efforts, including donations.

Entities of this kind typically hold commercial contracts, project documentation, employee records, partner and investor information, and data related to land, construction and urban development. Because the firm operates at the intersection of real estate, infrastructure and investment, a breach can affect not only staff but also suppliers, joint-venture partners and individuals whose details appear in project or community files. The consequential nature of an incident here stems from the breadth of commercial and personal data such an organisation ordinarily processes, even when the exact contents of any stolen archive remain unconfirmed.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, databases or record categories has been disclosed. The number of people affected is unknown. Organisations engaged in real-estate development, infrastructure investment and large-scale partnerships commonly store employee personal data, contractor and vendor details, financial and contractual documents, project plans, and sometimes information about residents or stakeholders connected to developments. Whether any of those categories are present in the material claimed by thegentlemen has not been independently confirmed.

Because the exact contents remain unconfirmed, it is not possible to state with certainty which individuals or which specific data elements are involved. The only concrete description available is the group’s claim of internal-file exfiltration.

What's at stake

For people whose information may be among the internal files, the practical risks include identity misuse, targeted phishing that references real project or employment details, and longer-term exposure of personal or financial data. Even when full archives are not immediately published, the existence of a claimed exfiltration creates an ongoing possibility that the data could surface later. For the organisation, the stakes include operational disruption, potential regulatory scrutiny under applicable data-protection rules, reputational damage with partners and investors, and the cost of investigation and remediation.

Because the scale of the incident and the precise data types remain undisclosed, the full extent of harm cannot yet be measured. The absence of confirmed numbers does not eliminate risk; it simply means affected individuals and the company itself must proceed on the basis of incomplete information while further facts emerge.

What to do if you're exposed

If you have a connection to Donacoop (VinaCapital)—as an employee, contractor, partner, investor or resident linked to its projects—treat the listing as a reason to take basic protective steps even while official confirmation is limited.

• Monitor financial and email accounts for unexpected activity or password-reset attempts that reference the company or its projects.
• Enable multi-factor authentication on important accounts and change passwords that may have been reused in work-related systems.
• Be cautious of unsolicited messages that appear to come from the organisation or its partners; verify any request for personal or financial information through a known channel.
• Keep records of any unusual contact so you can report it if needed.
• Run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets.

These measures do not depend on final confirmation of the breach’s scope. They reduce the chance that any exposed data can be used against you while more detail becomes available. Public reporting continues to treat thegentlemen’s listing as a claim rather than a fully verified event; staying alert remains the most practical response for those who may be affected.

AICompiled with AI assistance from public sources and published under our editorial standards.