José Guma S.A. Listed by dragonforce Ransomware Group

On October 16, 2025, Argentine household-chemical manufacturer José Guma S.A. appeared on the leak site of the dragonforce ransomware group. The company, which produces soap, cleaning products and contract-manufactures for third-party brands, is claimed to have had internal files exfiltrated during a ransomware attack. Public reporting indicates the victim count among customers, suppliers and employees remains unknown.

Reported Details of the Breach

José Guma S.A. operates from Colonia Caroya in Córdoba Province, Argentina, with a factory at Lot 1, Barrio Malabrigo. The company is led by president Jorge Alfredo Gleria and participates in the Roundtable on Sustainable Palm Oil. Available reporting describes the incident as a classic ransomware operation: initial access, data exfiltration, followed by encryption and an extortion demand. The files posted to the dark-web leak site contain internal company documents whose precise sensitivity has not been publicly detailed.

dragonforce gave the usual public deadline for payment before promising further leaks. No independent confirmation of the exact volume or categories of stolen data has surfaced beyond the group’s own claims.

Why This Matters for You and Your Family

Even when a breach hits a manufacturer rather than a bank or retailer, ordinary families feel the impact. If you or your relatives have bought the company’s private-label cleaning products, worked with one of its contract partners, or appear in supplier or employee records, your personal information may now sit inside the exfiltrated files. Names, addresses, phone numbers, email accounts and payment details are the kinds of records manufacturers routinely keep. Once those records leave the company’s control, they can be sold, traded or used to launch targeted attacks against you.

The Doxxing and Identity-Chain Risk

Ransomware groups rarely stop at posting company spreadsheets. The data they release often lets opportunistic criminals connect the dots between corporate records and personal identities. A supplier invoice can reveal home addresses; an employee directory can expose family members’ names and dates of birth. These fragments become the starting point for doxxing chains that link gaming handles, social-media accounts, phone numbers and physical locations. Children’s gaming accounts are especially vulnerable because parents frequently reuse passwords or security questions across work-related breaches and family entertainment services.

Dragonforce’s Publicly Known Track Record

Public reporting attributes the group’s emergence to late 2023. It has since listed victims ranging from regional manufacturers to logistics firms and healthcare providers. The typical playbook begins with phishing or exploited remote-access tools, followed by exfiltration of sensitive files, deployment of ransomware, and dual extortion: demanding payment to decrypt systems and threatening to publish stolen data. dragonforce maintains an active leak site and consistently follows through on publication when ransoms are not paid.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate the passwords you used at any service tied to José Guma S.A. or its partners, and switch on 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure surfaces in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to the same credential chains.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your own accounts.

The pace of ransomware leaks shows no sign of slowing. Protecting your family now means treating every breach as a link in a potential identity chain rather than an isolated corporate event. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today and close the gaps before the next leak appears.