Selartex Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 23 August 2025, the French home-textiles wholesaler Selartex appeared on a leak site operated by the ransomware group dragonforce. The listing asserts that internal files were taken during a ransomware attack. The number of people whose information may be involved remains unknown, and the precise contents of the files have not been publicly detailed. For customers, suppliers and staff who deal with the company, the practical concern is straightforward: any personal or commercial data held in those systems could now sit outside the organisation’s control and may be used for fraud, phishing or further compromise.

Public reporting so far is limited to the group’s claim and the basic description of Selartex’s business. No independent confirmation of the breach’s scale or exact method has been released, so the full picture is still incomplete. What is clear is that a ransomware incident involving data theft raises lasting risks for anyone whose details were stored by the firm.

Inside the incident

According to the available record, Selartex was listed by dragonforce on 23 August 2025. The group states that internal files were exfiltrated as part of a ransomware attack. No figure for the volume of data, no list of specific file types beyond the general description “internal files,” and no confirmed timeline of when the intrusion began or ended have been published. The number of individuals affected is recorded as unknown. Method of initial access, encryption of systems, and any ransom demand remain undisclosed in the public facts. The listing itself is therefore best treated as an unverified claim by the threat actor until further evidence appears.

The group behind it: dragonforce

Dragonforce is a ransomware operation that has been active in recent years and is known for double-extortion tactics. The group typically encrypts a victim’s systems and simultaneously steals data, then threatens to publish the stolen material on a dedicated leak site if payment is not made. Listings on such sites serve both as pressure on the victim and as advertising of the group’s capabilities. Public reporting on dragonforce has described a pattern of targeting mid-sized organisations across multiple sectors, often after initial access via compromised credentials or unpatched services. The group has previously claimed responsibility for attacks on companies in Europe and elsewhere, though each claim must be evaluated separately. In the present case, dragonforce’s listing of Selartex is simply that—a claim—and does not by itself prove the full extent of any intrusion.

Who is Selartex?

Selartex is a French wholesaler specialising in home textiles. Public descriptions note more than 35 years of activity and a catalogue of over 6 000 items that includes bed linen, decorative textiles, table linen and bath linen. The company supplies professional buyers and emphasises quality at competitive prices while updating its range to match living trends. Organisations of this type routinely maintain customer and supplier databases, order histories, invoicing records, employee information and internal operational documents. A ransomware incident that involves the theft of internal files therefore carries consequences beyond the immediate disruption of warehouse or sales systems: it can expose commercial relationships and personal data belonging to people who never expected their details to leave the company’s control.

What data was at risk

The only data type named in the public record is “internal files exfiltrated in ransomware attack.” No further breakdown—such as customer lists, financial records, employee files or authentication credentials—has been confirmed. Wholesalers in the home-textiles sector typically hold names, addresses, telephone numbers and email addresses of trade customers, purchase histories, bank or payment details for suppliers, and internal staff records. Whether any of those categories were among the files taken remains unconfirmed. Until more precise information is released by the company or by independent investigators, the exact contents of the stolen material cannot be stated as fact.

The real-world impact

For individuals whose data may have been included, the risks are concrete rather than abstract. Stolen contact details and order information can be used to craft convincing phishing messages that appear to come from Selartex or its partners. Financial or identity data, if present, can facilitate account takeover or invoice fraud. Even purely commercial documents can reveal pricing, supplier terms or customer volumes that competitors or fraudsters might exploit. For Selartex itself, the incident can mean operational downtime, the cost of forensic investigation and remediation, potential regulatory scrutiny under European data-protection rules, and lasting damage to trust among the professional buyers who rely on the firm. Because the number of people affected is unknown, the full scope of these effects cannot yet be measured.

Were you affected?

If you have done business with Selartex as a customer, supplier or employee, treat the possibility of exposure seriously even though the precise data set is unconfirmed. Practical first steps include:

• Monitor bank and payment accounts for unexpected activity and enable transaction alerts where available.
• Treat any unsolicited email, call or message that references Selartex orders or accounts with caution; verify through known contact channels before responding or clicking links.
• Change passwords for any accounts that used the same credentials as those shared with the company, and enable multi-factor authentication wherever it is offered.
• Request a free exposure scan of your email address against known breach data sets to see whether your information has already appeared in other incidents.
• Keep records of any suspicious contact and report confirmed fraud to the relevant national authorities.

Further official statements from Selartex or French regulators may clarify the situation; until then, the safest course is to assume that internal files left the company’s control and to act accordingly.

AICompiled with AI assistance from public sources and published under our editorial standards.