Dolidol Listed by The Gentlemen Ransomware Group

On September 9, 2025, Moroccan mattress manufacturer Dolidol appeared on the leak site of the ransomware group known as thegentlemen. The company, which operates 46 stores and supplies polyurethane foam, mattresses, sofas and non-woven textiles across Morocco, is claimed to have had internal files exfiltrated during a ransomware attack.

Reported Details of the Incident

Public reporting indicates that Dolidol, founded in 1972 and long regarded as a higher-end brand in its market, was listed by thegentlemen ransomware operators. The data exposed consists of internal files taken during the attack on the company’s systems. No confirmed victim count for individuals has been released, and the precise volume or sensitivity of the stolen documents remains unclear from available reporting. The listing appeared on the group’s dedicated leak site, accessible via the onion address hosted on the ransomware.live tracker.

Why This Matters for You and Your Family

When a company like Dolidol suffers a breach, the information it holds about customers, suppliers, employees and business partners can end up in the hands of criminals. That often includes names, addresses, phone numbers, email accounts, order histories and payment details. For ordinary families who have bought mattresses, sofas or home furnishings from Dolidol or its distributors, the leak can create long-term privacy risks. Once those details surface on dark-web forums or ransomware leak sites, they become raw material for identity theft, phishing campaigns and harassment that can reach you at home.

Credential leaks like this one frequently cascade into account takeovers on other services where the same email and password combination is reused. Children’s online accounts, including gaming profiles tied to family email addresses or phone numbers, are especially vulnerable because kids rarely use unique credentials.

The Doxxing and Identity-Chain Implications

Ransomware groups do not stop at posting generic “internal files.” They often comb through stolen documents for personally identifiable information that links online handles, email addresses, phone numbers and physical addresses. This creates an identity chain: one leaked record leads to another, allowing attackers or opportunistic criminals to build detailed profiles. Public reporting describes how such chains are then used for doxxing, targeted phishing, or extortion against individuals whose data was never meant to be public. In households where family members share devices or email domains, a single breach can expose parents, children and extended relatives at once.

Thegentlemen Ransomware Group’s Track Record

Public reporting attributes the group’s emergence to 2024. It has targeted organizations across multiple countries, focusing on mid-sized companies in manufacturing, services and technology sectors. Notable prior victims include firms whose internal documents, employee records and customer databases were published after ransom demands went unmet. The typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by claimed exfiltration of sensitive files and deployment of ransomware. If payment is not received, thegentlemen publishes samples or full datasets on its leak site with countdown timers, aiming to pressure victims through reputational damage and the threat of further data sales.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you used on dolidol.ma or with any Dolidol distributor, and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your own accounts.

The incident shows that even established regional companies can become targets, leaving ordinary customers exposed without warning. Taking concrete steps now limits how far a single breach can follow you or your family. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered online details back to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage also protects children’s gaming accounts that frequently become entry points for further attacks after credential leaks like this one.