Delkart Industries Pvt Data Breach

The Gentlemen ransomware group has added Delkart Industries Pvt, a manufacturing company based in India, to its leak site on July 30, 2026. This listing adds Delkart to a growing number of targets, with manufacturing being the sector most frequently exploited by The Gentlemen. SOCRadar’s Dark Web Monitoring identified this listing, highlighting the ongoing threat posed by this ransomware group, particularly to organizations in the manufacturing sector. In the 60 days preceding this listing, The Gentlemen claimed 175 other victims, positioning them as one of the most active ransomware operations currently tracked. While manufacturing is their primary target, they also frequently target Business Services and Healthcare sectors. Their victim base is predominantly located in the United States, India, and France. Delkart Industries Pvt’s placement within this attack pattern aligns with the group’s focus on the manufacturing sector and their significant activity in India, making it a potentially attractive target.

A query for delkartindustries[.]com within SOCRadar’s stealer-log datasets returned no exposure records in the searched segment. This domain was also included in a consolidated digest of recent victims, indicating no direct correlation with immediately available compromised credentials. However, this absence of evidence does not definitively confirm that the organization is unaffected. The stealer-log query was limited to a paginated sample of a specific dataset. It is possible that credentials could exist under a sibling domain, utilize personal email aliases associated with corporate accounts, or have been indexed in feeds not covered by this query. Furthermore, credentials may have been compromised and rotated prior to the logging or indexing period. For ransomware operations like The Gentlemen, infostealer-harvested credentials are a common initial access vector. Threat actors or access brokers often acquire these credentials, validate them against corporate accounts, and then attempt to gain access to systems via

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.