AIRCOS Listed by thegentlemen Ransomware Group

On April 4, 2026, French cosmetics manufacturer Aircos Pascual appeared on the leak site of the ransomware group known as thegentlemen. The company, which forms part of the ANJAC Group and supplies major beauty brands with loose powders, hot-cast formulas, lip fluids and foundation fluids, is claimed to have had internal files exfiltrated during a ransomware attack. While the exact number of people whose data may have been exposed remains unknown, any current or former employees, contractors, suppliers or customers whose information was stored in those systems could now be at risk.

What's Publicly Reported from Reporting

Public reporting indicates that Aircos Pascual, a firm with roughly 300 employees and three production sites in France, was listed on thegentlemen’s leak portal. The data consists of internal files taken during a ransomware incident. No specific samples of the stolen material have been publicly detailed beyond the group’s claim of successful exfiltration. The listing appeared on April 4, 2026, according to the primary leak-site record hosted on ransomware.live.

Why This Matters for You and Your Family

When a company like Aircos Pascual suffers a breach, the information inside its systems often includes names, addresses, phone numbers, email accounts, employee IDs, supplier contracts and customer records. If you or anyone in your household has ever worked there, purchased their products directly, or been listed as a business contact, your details may now sit on a criminal leak site. That information can be combined with other leaks to build a complete picture of your life. Criminals do not need every record at once; even small fragments let them impersonate you, open accounts in your name, or target your family members. Children’s school or medical details sometimes appear in corporate files through dependent coverage, making the entire household vulnerable.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently contain spreadsheets that link personal email addresses to corporate logins, phone numbers to employee directories, or customer records that tie physical addresses to payment details. Once these connections surface, attackers can follow the chain across social media, gaming platforms and data-broker listings. A credential found in one breach can unlock accounts on unrelated services where the same password or email was reused. This is exactly why credential leaks like this one cascade into account takeovers and doxxing chains. Gaming accounts belonging to you or your children are especially attractive targets because they often share the same email address or recovery phone number listed in employment or customer records.

The Group’s Publicly Known Track Record

Public reporting attributes the attack to thegentlemen, a ransomware operation that emerged in late 2024. The group has claimed responsibility for incidents against mid-sized manufacturing, technology and professional-services companies. Its typical playbook involves initial access through phishing or exploited remote desktop services, followed by deployment of ransomware to encrypt systems. After exfiltration, the group posts samples on its leak site and demands payment to prevent full data release. Extortion timelines are usually short, with deadlines measured in days or weeks. Thegentlemen is still considered a relatively new entrant compared with longer-established ransomware families, yet it has shown consistent use of double-extortion tactics.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what this claimed breach connects to.
• Rotate the password you used at Aircos Pascual or any related ANJAC Group service anywhere it has been reused, and switch on two-factor authentication through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next time your information appears it is caught within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses or recovery emails found in corporate files.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to chase every copy of your information yourself.

The speed with which stolen corporate data moves from leak sites into criminal marketplaces means ordinary families must act quickly and systematically. Starting with a clear map of your exposed information and maintaining ongoing visibility gives you the best chance of staying ahead of the next stage of the attack. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full family and household coverage including children’s gaming accounts.