Donacoop (VinaCapital) Listed by thegentlemen Ransomware Group

On February 19, 2025, the ransomware group known as thegentlemen listed Donacoop (VinaCapital) on its leak site, claiming that internal files had been exfiltrated from the Vietnamese conglomerate during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates the incident involves a major Vietnamese company headquartered in Dong Nai province. Donacoop originally grew from agricultural and handicraft cooperatives and has become a significant player in real estate and infrastructure development. The company has partnered with VinaCapital on metro line extension projects and worked with Keppel Land on large developments such as Dong Nai Waterfront City. It has also engaged in philanthropic activities including donations.

Available reporting describes the data taken as internal files. The number of people whose information appears in the stolen material remains unknown. No specific deadline for payment has been publicly detailed in the initial listing, though ransomware groups typically issue such ultimatums after exfiltration.

Why This Matters for You and Your Family

When a company like Donacoop suffers a breach, the information inside its files often includes details about customers, partners, employees, and vendors. If your name, address, phone number, email, or financial records were stored in those systems, they may now sit on a dark-web leak site. That data can be sold, traded, or used to target you directly.

Ordinary families in Vietnam and those who have done business with Donacoop or its partners are potentially exposed. A single leak can lead to spam, phishing emails, fraudulent loan applications, or worse. Children’s school records, family addresses, or parents’ workplace details sometimes appear in corporate files, giving attackers multiple avenues into your household.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently contain spreadsheets that link names to addresses, phone numbers, email accounts, and sometimes national identification numbers. Attackers combine this information with data from previous breaches to build a complete picture of your life. One exposed email can reveal your username on shopping sites, social media, and gaming platforms. That username can then be tied to your real identity, creating an identity chain that grows longer with every new leak.

Credential leaks like this one cascade into account takeovers and doxxing chains. Gaming accounts belonging to you or your children are especially vulnerable because kids often reuse simple passwords or email addresses tied to family domains. Once an attacker controls a child’s Roblox, Minecraft, or Steam account, they can demand ransom from the parents or use the account to spread malware to friends.

Thegentlemen Group’s Known Track Record

Public reporting attributes the group’s emergence to 2024. It has targeted organizations across multiple countries and sectors, typically gaining initial access through phishing, exploited remote desktop protocols, or stolen credentials. After entering a network the group exfiltrates sensitive files before encrypting systems. Its playbook then shifts to extortion: thegentlemen threatens to publish the data on its leak site unless payment is made. Notable prior victims have included companies whose internal documents, employee records, and customer information were later posted when negotiations failed.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this claimed breach may have exposed.
• Rotate the password you used for any Donacoop-related services or portals anywhere it has been reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears you learn about it within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts which often chain back to the same addresses and family emails.
• Let remediation specialists handle the follow-up work, including sending takedown requests to data brokers and monitoring for resale of the stolen files.

The incident shows that even established regional companies can lose control of sensitive data with little warning. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with this leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts.