Ransomware Group thegentlemen Hits: Edcon
Summary
In the latest cybersecurity news, Edcon — an organization based in ZA — has fallen victim to a ransomware attack conducted by the group thegentlemen. This data breach, discovered on 2026-09-30T03:40:25.808942+00:00, underscores the increasing need for proactive cybersecurity defenses as we continue through 2026.
Incident Report
| Attribute | Information |
|---|---|
| Target Organization | Edcon |
| Threat Group | thegentlemen |
| Summary | edcon.co.za zoominfo.com/c/edcon/36900910 Edcon (roots from 1929, Johannesburg) was South Africa’s largest non-food retailer — owner of iconic chains Edgars, Jet, CNA and Boardmans, with ~1,200 stores across Southern Africa, ~19,000 staff, revenue of R25+ billion and four million private-label credit cards. It was crippled by Bain Capital’s 2007 leveraged buyout (~R25 billion), losing market share to discounters before COVID-19 lockdown wiped out R2 billion in sales and forced business rescue in April 2020. The group was then broken up: Jet was sold to The Foschini Group (~R480m), Edgars to Retailability (~R350m, 5,200 jobs saved), CNA and credit books to other buyers. The Edcon holding company itself no longer trades — edcon.co.za is now a business-rescue notice board where practitioners Marsden and Schapiro distribute sale proceeds to creditors (payments started September 2024, proceedings still open as of 2025). |
| Date of Breach | 2026-09-29T14:44:09+00:00 |
| Discovery Date | 2026-09-30T03:40:25.808942+00:00 |
| Region | ZA |
| Target Domain | edcon.co.za |
| Business Sector | Manufacturing |
How to reduce your ransomware risk
Most ransomware intrusions start with a stolen password or a phishing email. A few proactive steps sharply cut your exposure:
- phishing simulations — close the gap attackers exploit.
- awareness training — close the gap attackers exploit.
Want to know if you’re already exposed? Run a free scan with the HookPhish data breach checker.
Disclaimer
HookPhish does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.
Related articles
Ransomware Group N0n Hits: Eurogate Tanger (container terminal operations)
Ransomware Group N0n Hits: Camellia Line (ferry and RoRo operations)