Close Menu

THEGENTLEMEN · Threat actor profile

// THREAT ACTOR

THEGENTLEMEN_

Unknown

THEGENTLEMEN is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of THEGENTLEMEN — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

0 Victims tracked
0 / 0 Active mirrors
— First listing
— Most recent

// CONFIRMED ATTACKS

Thegentlemen confirmed attacks: 71 verified incidents

Ransomnews has verified 71 Thegentlemen incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from September 2025 to August 2026. Japan accounts for 9 of them (13%), with victims recorded in 35 countries in total. The most affected sector is manufacturing, at 16 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 70. Where a figure was disclosed (7 cases), these incidents account for 796,140 exposed records.

71Verified incidents
35Countries
2025–2026Active range
0%Paid, where outcome known

Confirmed victims by year

  • 20254
  • 202667

Most affected sectors

  • Manufacturing16
  • Government13
  • Other11
  • Healthcare10
  • Education6
  • Retail4
  • Finance3
  • Food and Beverage2

Most affected countries

  • Japan9
  • United States8
  • Poland7
  • France4
  • Brazil3
  • Taiwan3
  • Germany3
  • Australia2

Verified Thegentlemen incidents

DateOrganisationSector LocationRecordsRansom paidSource
August 2026 PharmaEssentia (Panco Healthcare) Healthcare Taipei, Taiwan — Unknown Source
July 2026 HIWIN S.r.l. Manufacturing Agrate Brianza, Italy — Unknown Source
July 2026 Oldelval (Oleoductos del Valle) Other Cipolletti, Argentina — Unknown Source
July 2026 Kenaitze Indian Tribe Government Alaska, United States — Unknown Source
July 2026 AnMed Healthcare South Carolina, United States — Unknown Source
July 2026 Thialf BV Other Heerenveen, Netherlands — Unknown Source
July 2026 Herbaház Retail Budapest, Hungary — Unknown Source
July 2026 Gallant Finland Finance Tampere, Finland — Unknown Source
July 2026 Metro Mondego Government Coimbra, Portugal — Unknown Source
July 2026 Ecopetrol S.A. Other Bogotá, Colombia 3,300 Unknown Source
July 2026 Royal Foods Aust Pty Ltd Food and Beverage Hemmant, Australia — Unknown Source
July 2026 Spedidam Other Paris, France — Unknown Source
June 2026 Arabia Falcon Insurance Company Finance Muscat, Oman — Unknown Source
June 2026 TKMS ATLAS North America, LLC Manufacturing Virginia, United States — Unknown Source
June 2026 Indra Group (subsidiary) Manufacturing Madrid, Spain — Unknown Source
June 2026 Stadttheater Gießen Other Gießen, Germany — No Source
June 2026 Au Vieux Campeur Retail Paris, France — Unknown Source
June 2026 Akademia Leona Koźmińskiego - Kozminski University Education Warsaw, Poland — Unknown Source
June 2026 Nationalmuseet Government Copenhagen, Denmark — Unknown Source
June 2026 Ministarstvo zdravstva Republike Hrvatske Government Zagreb, Croatia — Unknown Source
June 2026 Mackay Sugar Food and Beverage Ooralea, Australia — Unknown Source
June 2026 Feuerwehr Allensbach Government Allensbach, Germany — Unknown Source
May 2026 Soniva Dental Care Healthcare Texas, United States 30,000 Unknown Source
May 2026 DEVCO Sp. z o.o. Other Warsaw, Poland — Unknown Source
May 2026 The City of Boyne City Government Michigan, United States — Unknown Source
May 2026 Constructions Piraino Construction Wasquehal, France — Unknown Source
May 2026 IP Rings Limited Manufacturing Tamil Nadu, India — Unknown Source
May 2026 Wielkopolskie Centrum Medyczne REMEDIUM sp. z o.o. Healthcare Poznań, Poland — Unknown Source
May 2026 Koa Glass Co., Ltd. Manufacturing Tokyo, Japan — Unknown Source
May 2026 Vysoká škola finanční a správní (University of Finance and Administration) Education Prague, Czechia — Unknown Source
May 2026 Instituut voor de Nederlandse Taal Other Leiden, Netherlands — Unknown Source
May 2026 Oriental Diamond Co., Ltd. Manufacturing Tokyo, Japan — Unknown Source
April 2026 Gator Cases, LLC Manufacturing Florida, United States 1,171 Unknown Source
April 2026 Arçelik A.Ş. Manufacturing Istanbul, Turkey — Unknown Source
April 2026 Digiprint sp. z o. o. Service Warsaw, Poland — Unknown Source
April 2026 Nostrum Co., Ltd. Technology Tokyo, Japan — Unknown Source
April 2026 East Co., Ltd. Service Tokyo, Japan — Unknown Source
April 2026 Marutake Co., Ltd. Healthcare Nigata, Japan — Unknown Source
April 2026 Heinrich Kopp GmbH Manufacturing Kahl am Main, Germany — Unknown Source
April 2026 Anderlues la Commune Government Anderlues, Belgium — Unknown Source
April 2026 Gem Terminal Industry Co., Ltd. Manufacturing Kaohsiung, Taiwan — Unknown Source
March 2026 Rajagiri Hospital Healthcare Ernakulam, India — Unknown Source
March 2026 JRK Property Holdings, Inc. Other California, United States 19,919 Unknown Source
March 2026 Adaptavist Technology London, United Kingdom — Unknown Source
March 2026 Zámek Náměšť nad Oslavou Government Náměšť nad Oslavou, Czechia — Unknown Source
March 2026 IntraCare Healthcare Auckland, New Zealand — Unknown Source
March 2026 Caja de Seguro Social (CSS) Government Clayton, Panama — Unknown Source
March 2026 SATS Sverige Other Stockholm, Sweden — Unknown Source
March 2026 Omikenshi Co., Ltd. Manufacturing Osaka, Japan — Unknown Source
March 2026 MEDICUS SHUPPAN, Publishers Co., Ltd Other Osaka, Japan 641,000 Unknown Source
February 2026 Hospital ⁠Caribbean Medical Center Healthcare Fajardo, Puerto Rico 92,000 Unknown Source
February 2026 Sasin School of Management Education Bangkok, Thailand — Unknown Source
February 2026 Grand Hotel Taipei Other Taipei, Taiwan — Unknown Source
February 2026 Universidade Federal de Sergipe Education São Cristóvão, Brazil — Unknown Source
February 2026 CHS Villach Education Villach, Austria — Unknown Source
February 2026 ⁠Instituto Nacional de Derechos Humanos Government Santiago, Chile — Unknown Source
February 2026 Centro Universitário Filadélfia (UniFil) Education Londrina, Brazil — Unknown Source
January 2026 ⁠HAFA Manufacturing Yvetot, France — Unknown Source
January 2026 Hart Sp. z o.o. Retail Opole, Poland — Unknown Source
January 2026 Unimed Anápolis Healthcare Anápolis, Brazil — Unknown Source
January 2026 Nishiyama Seisakusho Co., Ltd. Manufacturing Odawara, Japan — Unknown Source
January 2026 Rogers Capital Credit Finance Port Louis, Mauritius — Unknown Source
January 2026 Gady Family Retail Lebring, Austria — Unknown Source
January 2026 Wamtechnik sp. z o.o. Manufacturing Piaseczno, Poland — Unknown Source
January 2026 Sincere Co., Ltd. Utilities Tokyo, Japan — Unknown Source
January 2026 Witzenberg Municipality Government Ceres, South Africa — Unknown Source
January 2026 Ayuntamiento de Beniel Government Beniel, Spain — Unknown Source
December 2025 Grupa Systherm Manufacturing Poznań, Poland — Unknown Source
December 2025 Complexul Energetic Oltenia Government Targu-Jiu, Romania — Unknown Source
November 2025 The Devereux Foundation Healthcare Pennsylvania, United States 8,750 Unknown Source
September 2025 Al-Babtain Power & Telecommunication Co. Manufacturing Cairo, Egypt — Unknown Source

Claimed vs confirmed. The figures above the fold on this page come from Thegentlemen's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.