José Guma S.A. listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: Spain
• Sector: Agriculture and Food Production
• Announcement date: November 5, 2025

The threat actor known as dragonforce has listed the organization José Guma S.A. on its leak site, claiming to have exfiltrated data from the company. This announcement, which constitutes a data leak claim, was published on November 5, 2025. According to the group's listing, the incident is alleged to have occurred on October 16, 2025.

Details of the claimed attack

The dragonforce ransomware group has published a claim involving José Guma S.A., asserting that they have successfully breached the organization and stolen sensitive information. The group's announcement specifies that the volume of compromised data is approximately 75.44 GB. While the group has published this information on their dedicated leak site, the exact nature of the leaked data has not been specified by the attackers.

In modern cyberattack landscapes, ransomware groups often employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. This allows the threat actors to pressure the victim through the threat of public exposure. By hosting data on a leak site, the group aims to damage the victim's reputation and force compliance with ransom demands, although no specific ransom demand has been mentioned in this particular listing.

Data involved in the incident

The listing by dragonforce provides specific details regarding the volume of the alleged theft, but it remains vague regarding the specific categories of information stolen. The following details have been identified from the claim:

• Claimed data size: 75.44 GB

The listing does not specify the exact file count or the specific types of files contained within the 75.44 GB of data. However, given the company's focus on household chemicals and hygiene products, it is possible that commercial and operational data may be included in the stolen dataset.

About José Guma S.A.

José Guma S.A. is an Argentina-based company that produces household chemicals, cleaning products, and soap. In addition to its own product lines, the organization provides contract manufacturing services for third-party brands, making it a participant in various supply chains.

Impact and risk assessment

This incident may pose significant risks to José Guma S.A. regarding operational continuity and commercial reputation. If the leaked data includes employee or customer information, it could facilitate identity theft or targeted phishing attacks. Furthermore, the organization may face legal obligations under Argentine data protection regulations due to the potential exposure of sensitive information.

The structure of the dragonforce group, which provides infrastructure to affiliates, may lead to the leaked data being utilized in secondary attacks by other actors. This modular approach to cybercrime means that once data is leaked by a primary actor, it can be harvested by various malicious entities for different purposes. Additionally, the company's supply chain partners may also be indirectly affected by this event, especially given the company's role in contract manufacturing.

For organizations operating in the agriculture and food production sectors, or those involved in chemical manufacturing, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits. Protecting the integrity of the supply chain is also vital, as a breach in one company can create ripple effects throughout its network of business partners and clients.