José Guma S.A. Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a company that makes everyday household products appears on a ransomware group's listing, the practical concern for ordinary people is straightforward: internal files may have left the organisation's control, and those files can contain personal or commercial details that create lasting inconvenience or risk. Public reporting so far does not confirm how many individuals are involved or exactly which records were taken, yet the mere claim of exfiltration is enough to warrant careful attention from anyone who has dealt with the firm as an employee, contractor, supplier or customer.

José Guma S.A., an Argentine manufacturer of soaps, cleaning products and contract-manufactured hygiene goods, was listed by the dragonforce ransomware group on 16 October 2025. The listing asserts that internal files were stolen in a ransomware attack. Beyond that claim, the number of people affected and the precise contents of the files remain undisclosed.

What happened

According to the public record of the incident, José Guma S.A. was named on a dragonforce leak site on 16 October 2025. The group claims that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access method, the duration of the intrusion, the volume of data taken, or any ransom demand—have been released in the available facts. The number of people whose information may be involved is listed as unknown. At present the listing itself constitutes an unverified claim by the threat actor rather than an independently confirmed breach report from the company or regulators.

Who is dragonforce?

Dragonforce is a ransomware group that has operated in the public eye for some time, typically following a ransomware-as-a-service model. Groups of this type commonly gain access to corporate networks, encrypt systems, and exfiltrate data before posting victim names on dedicated leak sites to increase pressure. They frequently claim to have stolen internal documents, databases or other corporate material and threaten to publish it if payment is not made. Public reporting on dragonforce has documented similar listings of organisations across multiple sectors and countries; the group’s statements about any single victim, including José Guma S.A., should be treated as claims until corroborated by independent sources. No additional statements by dragonforce specific to this incident beyond the listing itself appear in the available facts.

Who is José Guma S.A.?

José Guma S.A. is a manufacturer based in Colonia Caroya, Córdoba Province, Argentina. Its operations centre on the production of household chemicals and hygiene products—soaps, cleaning agents and related goods—as well as contract manufacturing for third-party brands. The company’s infrastructure includes a site at Lot 1, Malabrigo (Barrio Malabrigo, Córdoba). Public records identify Jorge Alfredo Gleria among its leadership as one of the heads or president. The firm participates in sustainability initiatives, including membership in the Roundtable on Sustainable Palm Oil (RSPO). Organisations of this kind typically maintain records of employees, suppliers, customers, production formulas, quality-control data and commercial contracts. A ransomware incident that involves the claimed theft of internal files therefore raises questions about both personal information and proprietary business material.

What was likely exposed

The only data type named in the available facts is “internal files exfiltrated in a ransomware attack.” No inventory of specific document categories, file counts or data fields has been disclosed. Companies engaged in household-chemical production and contract manufacturing commonly hold employee personnel files, payroll and tax records, supplier and customer contact lists, purchase orders, product formulations, quality and safety documentation, and internal correspondence. Whether any of those categories were among the files claimed by dragonforce remains unconfirmed. Readers should therefore treat the precise contents as unknown until the company or an independent investigation provides further detail.

What's at stake

For individuals whose details may appear in the stolen material, the practical risks include possible misuse of contact information, identity-related fraud if personal identifiers were present, or targeted phishing that leverages knowledge of the company’s products or relationships. Employees and contractors could face exposure of employment or financial records; suppliers and customers might see commercial terms or contact data circulate. For the organisation itself, the consequences can include operational disruption, loss of proprietary formulations or process knowledge, reputational harm among partners, and the cost of investigation and remediation. Because the scale of the claimed exfiltration and the exact data types remain undisclosed, the full extent of these risks cannot yet be quantified. The listing alone, however, is sufficient to place both personal and commercial information under potential threat.

What to do if you're exposed

If you have reason to believe your information may have been held by José Guma S.A.—as a current or former employee, contractor, supplier or customer—begin with basic protective steps. Monitor bank and credit accounts for unexpected activity, enable multi-factor authentication on email and financial services, and treat unsolicited messages that reference the company or its products with caution. Change passwords that may have been reused across work and personal accounts. Keep records of any suspicious contact. Because public detail on this incident is still limited, you can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; such a scan provides an additional, independent signal while official confirmation remains incomplete.

AICompiled with AI assistance from public sources and published under our editorial standards.