vpcgroup.com customfoam.com Listed by thegentlemen Ransomware Group

On July 23, 2026, Canadian manufacturer Custom Foam Systems (operating as vpcgroup.com and customfoam.com) was listed on the leak site of the ransomware group known as thegentlemen. The listing states that internal files were exfiltrated during a ransomware attack. The company, founded in 1973 and based in Kitchener, Ontario, supplies fabricated and molded polyurethane foam components to the automotive, healthcare, and furniture industries. The leak-site entry does not disclose the number of records affected, the specific types of documents taken, or any ransom demand.

Reported Details from the Listing

The primary disclosure on the thegentlemen leak site, archived via ransomware.live, states that both vpcgroup.com and customfoam.com domains belonging to Custom Foam Systems were posted on July 23, 2026. It explicitly states that internal files were exfiltrated following a ransomware deployment. No sample data has been published at the time of the listing, and the notification does not quantify how many employees, customers, or business partners may be impacted. Public details about the initial access vector or exact date of compromise also remain undisclosed by the group.

Why This Matters for You and Your Family

If you have ever done business with Custom Foam Systems, worked there, or had your information stored in their systems, your personal or employment data may now sit in an attacker-controlled archive. Even when exact record counts are unknown, ransomware groups routinely harvest employee names, addresses, dates of birth, Social Insurance Numbers, banking details for payroll, and customer or vendor contact information. Once exfiltrated, this data does not disappear. It circulates in underground markets and can be used for identity theft, tax fraud, or targeted phishing against you and your family members for years.

Doxxing and Identity-Chain Risks

Internal files from manufacturing companies frequently contain spreadsheets that link employee names to personal email addresses, phone numbers, home addresses, and sometimes spouse or dependent details. These datasets become the foundation for doxxing chains. Attackers cross-reference them with credential leaks, gaming account handles, and social-media profiles to build complete identity maps. A single exposed work email can lead to compromise of personal accounts, especially when the same password was reused. This is precisely why credential leaks like this one cascade into account takeovers and doxxing chains that can affect both adult household members and children’s gaming accounts tied to the same address.

The Gentlemen Ransomware Track Record

Public reporting attributes thegentlemen as a relatively new ransomware/extortion operation that emerged in late 2024. The group is known for targeting mid-sized manufacturing, distribution, and services companies across North America and Europe. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by claimed exfiltration of sensitive files before deploying ransomware. Rather than always encrypting systems publicly, they emphasize data theft and quiet extortion, threatening to release stolen internal documents if payment is not made. Notable prior victims have included other industrial and healthcare-adjacent suppliers, though exact success rates and total victims remain difficult to verify with certainty.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including cleanup of exposed records.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Rotate any password you ever used at Custom Foam Systems or vpcgroup.com wherever it has been reused, and secure those accounts with 2FA through an authenticator app instead of SMS.
• Cover the entire household — DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same breached corporate data.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf.

The incident underscores a persistent reality: even companies that appear far removed from your daily life can expose information that follows you and your family for years. Continuous visibility and rapid remediation remain the most practical defense. DoxxScan by GalaxyWarden delivers that through continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.