Groupe Caddac Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 21, 2026, the ransomware group thegentlemen listed Groupe Caddac on its leak site. The number of people affected is not known, and the only detail reported about the material is that internal files were allegedly exfiltrated during a ransomware attack. This listing raises the possibility that data belonging to the French construction-materials company and any individuals or partners referenced in its files may have been copied and could be published. Because the scale and exact nature of the exposure have not been confirmed, those connected to the company have limited information on which to base decisions about their own records.

What happened

The available information states only that Groupe Caddac was listed by thegentlemen and that internal files were exfiltrated in a ransomware attack. No figure for the volume of data, the number of records, or the date of the intrusion has been released. The listing itself constitutes the group’s claim; independent confirmation of the breach contents or the circumstances of the access has not been provided.

Who is thegentlemen?

Thegentlemen is a ransomware group that maintains a leak site on which it lists organisations it claims to have targeted. Public reporting on the group describes typical ransomware tactics of data exfiltration followed by demands for payment in exchange for withholding publication. No verified statements from the group about the Groupe Caddac incident exist beyond the listing itself.

Who is Groupe Caddac?

Groupe Caddac is a French company founded in 1962 that produces and supplies ready-mix concrete, prefabricated concrete elements, aggregates and other building materials. It is headquartered in Donges in the Pays de la Loire region and operates 19 concrete plants along the Atlantic coast. The organisation employs between 200 and 500 people and ranks among the top seven regional producers of ready-mix concrete in France. Companies of this type routinely hold records relating to customers, suppliers, employees, project specifications and financial transactions.

What was likely exposed

The only data category named in reports is internal files exfiltrated during the ransomware attack. The precise types of information contained in those files have not been disclosed. Organisations in the construction-materials sector commonly store employee records, client contracts, supplier details and operational documents; however, whether any of these categories were present in the exfiltrated material remains unconfirmed.

What's at stake

Exposure of internal files can create operational and privacy risks for the company and for any individuals whose details appear in those files. Potential consequences include misuse of commercial information, attempts at further unauthorised access, or the publication of personal data if the material is released. The absence of a confirmed record count means the extent of any individual impact cannot yet be assessed.

Were you affected?

Individuals who have worked with or for Groupe Caddac, or who have shared personal information with the company, can begin by monitoring their email accounts and financial statements for unusual activity. They may also contact the company directly for any official notification it issues. A free exposure scan of an email address against known breach data sets can provide an initial indication of whether the address has appeared in previously published records.

AICompiled with AI assistance from public sources and published under our editorial standards.