TheGentlemen claims Indian jeweller breach

A ransomware/extortion group calling itself TheGentlemen claims to have stolen data from a 110-year-old Indian jewellery retailer, Soni Dwarkadas Virchand.

Ransomware.live has indexed a leak-site posting attributed to a group referred to as 'TheGentlemen' claiming compromise of Soni Dwarkadas Virchand, a long-established family jewellery business based in Bhavnagar, Gujarat, India. The post claims exfiltration of confidential personal and customer data, financial and accounting documents, business correspondence and legal documents, internal databases, IT infrastructure details, credentials/access information, and technical documentation. No sample data or proof files are described in the source material beyond the claim itself.

The victim is a retail jewellery chain with a large physical footprint (a 6,100 sq ft jewellery mall) and an online/technology presence including a virtual try-on 'Bridal Studio'. Passive DNS/SPF reconnaissance associated with the victim domain (dwarkadasjewellers.com) reveals use of third-party mail relay services (mailbaby.net, mailchannels.net) and two IPv4 addresses listed in the SPF record; no other cloud/SaaS services were detected. This appears to be a standard extortion-site listing rather than a technical intrusion write-up, so there is no detail on initial access vector, malware used, or ransomware encryption behavior.

Defenders in the retail/jewellery and adjacent SME sectors should treat this as a reminder to verify exposure of customer and financial data, review third-party mail relay configurations, and monitor for credential leakage tied to the named domain. Given the limited technical detail and single-victim scope, this is assessed as routine extortion-group activity rather than a broad campaign.

Source reporting: https://www.ransomware.live/id/U29uaSBEd2Fya2FkYXMgVmlyY2hhbmRAdGhlZ2VudGxlbWVu