Superstore listed on thegentlemen leak site

• Ransomware group: thegentlemen
• Country: Georgia
• Sector: Retail & E-Commerce
• Announcement date: September 7, 2026

The retail company Superstore has been listed on a leak site by the threat actor group known as thegentlemen. The announcement, which appeared on September 7, 2026, indicates a significant data breach involving the Georgian organization.

The alleged attack and claims by thegentlemen

According to the announcement made on the group's leak site, thegentlemen claims to have successfully accessed the digital systems of Superstore. The group asserts that this unauthorized access allowed them to obtain various personal records belonging to the institution. While the group has made these claims, information regarding the specific identity, methods, or background of thegentlemen remains limited in the public domain.

The group appears to be employing double-extortion tactics. In such scenarios, threat actors do not merely encrypt an organization's data to demand a ransom for decryption; they also steal sensitive information and threaten to publish it online if the ransom is not paid. This method increases the pressure on the victim by leveraging the threat of public exposure and regulatory scrutiny.

Data types allegedly involved in the leak

The announcement claims that the stolen data includes a wide variety of sensitive personal and financial information. Although no screenshots were provided to verify the contents of the breach, the group claims the following data types are part of the leak:

• Emails
• Passwords
• Passport details
• Driving licenses
• Dates and places of birth
• Bank details
• Tax IDs
• Client cards
• Phone numbers
• Addresses

The sheer variety of the information mentioned suggests a deep level of access to the organization's databases, potentially impacting both customers and employees.

About Superstore

Superstore is a notable entity in the Georgian retail landscape. Founded in 2020 in Tbilisi, it holds the distinction of being Georgia's first zero-waste supermarket. The store operates on a unique package-free model, where customers are encouraged to bring their own containers to purchase food, cleaning supplies, and personal care products in bulk.

Implications and organizational risks

The alleged leak carries significant risks for the institution and the individuals involved. For the customers and employees of Superstore, the exposure of such sensitive information may increase the risk of identity theft and fraud. The presence of financial details, such as bank information and client cards, alongside personal identifiers like tax IDs and passport details, creates a high potential for secondary attack vectors, including targeted phishing campaigns and financial fraud attempts.

From a regulatory perspective, the sensitivity of the claimed compromised data could trigger administrative and legal processes regarding data protection regulations. Organizations facing such breaches are often required to fulfill data breach notification obligations, which involve informing the affected parties and relevant authorities about the nature of the incident.

Furthermore, the use of double-extortion tactics by the threat actor can lead to significant reputational damage for the institution. When sensitive customer data is published on a public leak site, it can erode consumer trust, which is vital for a retail business. To mitigate such risks, organizations in the retail and e-commerce sectors typically focus on robust data protection, continuous monitoring of digital systems, and comprehensive incident response plans to manage the legal and reputational consequences of a breach.