Ustar listed on thegentlemen leak site

• Ransomware group: thegentlemen
• Country: China
• Sector: Retail & E-Commerce
• Announcement date: January 20, 2026

The threat actor known as thegentlemen has listed the cosmetics company Ustar on their leak site. This announcement, made on January 20, 2026, involves a claim that the group has obtained data belonging to the organization.

The claimed attack and event details

According to the announcement posted on the thegentlemen leak platform, the group claims to have successfully targeted Ustar. The listing appeared on January 20, 2026, which aligns with the date the threat actor claims the attack took place. This type of activity is characteristic of modern ransomware operations, where threat actors often employ double extortion tactics. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive information to use as leverage during ransom negotiations.

While the group has publicly claimed to have obtained data belonging to the organization, the available information remains limited. The provided screenshot associated with the listing does not contain any data samples or detailed information regarding the specifics of the intrusion. Consequently, the exact methods used by the threat actor to gain access to the Ustar network have not been disclosed through this announcement.

Details regarding the alleged data breach

At this stage, there is no information available regarding the nature of the data allegedly leaked. The listing does not provide specifics concerning the content of the data, nor does it offer details regarding the volume of information involved. The screenshot provided by the threat actor does not contain any details regarding the content of the data.

• No data types were specified in the listing.

In many ransomware incidents, the lack of immediate detail in a leak site announcement is common, as groups often use the initial listing as a way to pressure the victim. Without specific data samples or a detailed inventory of stolen files, the full scope of the breach remains unknown to the public.

About Ustar

Ustar is a Thailand-based cosmetics company that offers makeup and skincare products for women. The organization specializes in a variety of beauty products, including eye, face, and lip makeup, as well as various skincare items.

Potential implications and industry risks

This incident suggests that customer or employee data within Ustar may have been compromised. If a data breach has occurred, it could negatively impact the organization's operational processes and customer trust. Furthermore, the organization may face legal obligations under China's data protection regulations (PIPL).

Beyond the immediate operational impact, secondary risks may be observed, such as identity theft or targeted phishing attacks. When sensitive information is exfiltrated, attackers often use it to conduct more sophisticated social engineering campaigns against the individuals whose data was stolen.

For organizations operating in the retail and e-commerce sectors, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security audits to identify vulnerabilities. Because public information about the thegentlemen group is limited, organizations must remain vigilant against their evolving tactics.

General cybersecurity context

Ransomware leak sites serve as a public gallery for threat actors to shame their victims. These sites are used to increase pressure on the targeted organization by threatening to release sensitive information to the public. For companies in the retail sector, which often handle significant amounts of consumer personal information, the risk of such leaks can lead to significant regulatory scrutiny and long-term reputational damage.