AIRCOS listed on thegentlemen ransomware leak site

• Ransomware group: thegentlemen
• Country: France
• Sector: Transportation
• Announcement date: April 4, 2026

Thegentlemen claims a data breach against AIRCOS

The threat group known as thegentlemen has announced an alleged data breach involving the entity AIRCOS. According to an announcement made on the group's leak site, the organization has been targeted in a cyberattack. This development follows a common pattern in modern cybercrime where threat actors utilize leak sites to claim responsibility for unauthorized access to corporate networks.

Ransomware groups often employ a tactic known as double extortion. In these scenarios, attackers do not merely encrypt a victim's files to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of releasing this stolen information on a public leak site serves as additional leverage to pressure the victim into paying a ransom. While the specific motives and methods of thegentlemen remain unclear due to limited public information regarding the group, their listing of AIRCOS marks a significant escalation in the incident.

Details of the alleged attack

The threat actor known as thegentlemen listed AIRCOS on their leak site on April 4, 2026. The group claims to have gained access to the organization's network and acquired various data sets. The timing of the announcement suggests a direct correlation between the alleged unauthorized access and the subsequent public listing.

Despite the claim of a successful intrusion, the group has not provided specific details or screenshots regarding the nature of the alleged leaked data. At this time, the listing names no specific data types that have been compromised.

The organization profile

AIRCOS is a French cosmetic manufacturer and part of the ANJAC Group. The company specializes in hybrid makeup technologies and provides a wide range of services, including research and development (R&D) and manufacturing for leading beauty brands. Their expertise focuses on specialized products such as loose powders, hot-cast formulas, and liquid foundations.

Potential impact and industry implications

The alleged breach may pose risks to the organization's operational continuity and intellectual property rights. Given AIRCOS's activities in the cosmetics manufacturing sector, the exposure of R&D data or client information could potentially impact its competitive position. The specialized nature of their manufacturing and R&D services means that proprietary formulas and technical processes are critical to their market standing.

Furthermore, as the entity operates within the European Union, any confirmed data breach could lead to regulatory consequences under the General Data Protection Regulation (GDPR). Beyond regulatory risks, the potential exposure of employee or client data may increase the risk of identity theft or targeted phishing attacks against the affected individuals. Such attacks often follow a breach, as stolen information is used to craft highly convincing social engineering campaigns.

For organizations operating in highly specialized manufacturing sectors, maintaining robust cybersecurity defenses is essential. Common defensive steps include implementing strict access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized movement. Additionally, protecting intellectual property through encryption and segmented networks can help mitigate the impact of a potential breach. As the situation regarding AIRCOS develops, the industry continues to monitor such incidents to better understand the evolving tactics of threat actors like thegentlemen.