The first place I'd look

In September, Charles & Keith said a cybersecurity incident had affected some of its servers.

What happened

Stores and online kept running. The company reported the matter to the authorities, brought in forensic specialists and started telling people what data might be involved. No evidence of misuse so far, it said.

Two days later, a ransomware group called The Gentlemen listed the company on its leak site. That’s their claim. Charles & Keith hasn’t said who it was or how they got in.

The bucket: not disclosed

We don’t know how they got in, so it goes under not disclosed - not under a guess.

Where AI comes in

What we do know is how that group usually works, because its own systems were hacked in May and Check Point read the leaked chats. They get in “almost always through an unpatched internet-facing device” - VPNs and firewalls - or with bought or stolen logins.

None of that is new. One of the firewall flaws Check Point says they use was published in January 2025, and the fix has been out since then. What’s changed is how cheap it is to go looking for the companies that haven’t applied it - and this group uses AI to move faster. Their administrator built their whole ransomware admin panel in three days with it.

That doesn’t tell us what happened at Charles & Keith. But it’s the first place I’d look in any company.

What I’d do

• Patch internet-facing devices first, especially VPNs and firewalls.
• Assume some logins are already stolen - multi-factor everywhere, and watch for odd sign-ins.
• Make sure your backups are offline and separate, because this group goes after them.