thegentlemen
Also known as: Storm-2697First seen September 9, 2025Active1,002 claimed victims
The claims below are reproduced as posted by thegentlemen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Stewart Engenharia | December 30, 2025 | ransomware_live | — |
| Solus Tecnologia em Sistemas LTDA | December 24, 2025 | ransomware_live | — |
| Santa Casa de Assis | December 24, 2025 | ransomware_live | — |
| All Rush | December 24, 2025 | ransomware_live | — |
| Ever Green Industria e Comercio Ltda | December 24, 2025 | ransomware_live | — |
| Usina Sao Jose Do Pinheiro | December 24, 2025 | ransomware_live | — |
| Solumek | December 19, 2025 | ransomware_live | — |
| ********.com | December 19, 2025 | ransomware_live | — |
| *****.com | December 12, 2025 | ransomware_live | — |
| ***.*** LAST TIMER UPDATE | December 10, 2025 | ransomware_live | — |
| Dongguan HYX Industrial | December 8, 2025 | ransomware_live | — |
| Everbiz Industrial Co. Ltd. | November 29, 2025 | ransomware_live | — |
| Devereux Advanced Behavioral Health | November 28, 2025 | ransomware_live | — |
| Ecuacorriente S.A. | November 25, 2025 | ransomware_live | — |
| KIM Dental | November 24, 2025 | ransomware_live | — |
| AiHealth | November 24, 2025 | ransomware_live | — |
| Singapore City Development Company Limited (SINGCONS) | November 24, 2025 | ransomware_live | — |
| NBCAPITAL JOINT STOCK COMPANY | November 24, 2025 | ransomware_live | — |
| Talarico | November 24, 2025 | ransomware_live | — |
| Pacific Holdings Group JSC. | November 23, 2025 | ransomware_live | — |
| Sansala | November 21, 2025 | ransomware_live | — |
| ***.*** | November 19, 2025 | ransomware_live | — |
| A***-****.com | November 17, 2025 | ransomware_live | — |
| AkroStar Technology Co., Ltd. Akrostar | November 17, 2025 | ransomware_live | — |
| ************.com | November 16, 2025 | ransomware_live | — |
| *******.com | November 12, 2025 | ransomware_live | — |
| St Stephen's International | November 4, 2025 | ransomware_live | — |
| St Stephens International | November 4, 2025 | ransomware_live | — |
| Silverlake Axis | October 30, 2025 | ransomware_live | — |
| ICET Studios | October 14, 2025 | ransomware_live | — |
| Personal Collection | October 9, 2025 | ransomware_live | — |
| Suzhou Yike Kejian | October 7, 2025 | ransomware_live | — |
| 2GO Group | October 5, 2025 | ransomware_live | — |
| Elundini | October 4, 2025 | ransomware_live | — |
| Astra Otoparts / PT. Inti Ganda Perdana | October 3, 2025 | ransomware_live | — |
| Al-Babtain Power & Telecommunication | September 29, 2025 | ransomware_live | — |
| Thai Future Inc. PCL | September 27, 2025 | ransomware_live | — |
| Cadisa | September 23, 2025 | ransomware_live | — |
| Instituto Socio-Económico Comunitario (INSEC) | September 17, 2025 | ransomware_live | — |
| ARMONIA MEDICAL S.A.S. | September 17, 2025 | ransomware_live | — |
| SV-Büro Ing. Schulz GmbH | September 16, 2025 | ransomware_live | — |
| Dolidol | September 9, 2025 | ransomware_live | — |
| Liceo Francés Antoine y Consuelo de Saint-Exupéry | September 9, 2025 | ransomware_live | — |
| Amv International Development | September 9, 2025 | ransomware_live | — |
| Ransomware Recover Indonesia | September 9, 2025 | ransomware_live | — |
| Kandeo | September 9, 2025 | ransomware_live | — |
| Proplastics | September 9, 2025 | ransomware_live | — |
| BIOLAP Soluciones Médicas | September 9, 2025 | ransomware_live | — |
| Ceres | September 9, 2025 | ransomware_live | — |
| Cervantes | September 9, 2025 | ransomware_live | — |
| Thin Red Line | September 9, 2025 | ransomware_live | — |
| LOCATION PEINTURES PRESTATIONS (LPP) | September 4, 2025 | ransomware_live | — |
| Saelen/Heizomat | September 1, 2025 | ransomware_live | — |
| Hydrometrics | August 25, 2025 | ransomware_live | — |
| Narumi (Thailand) Co.,Ltd. | August 19, 2025 | ransomware_live | — |
| Laboratorio Clinico Santa Rita | August 14, 2025 | ransomware_live | — |
| J.V.D.B. & Associates Inc | August 9, 2025 | ransomware_live | — |
| Venezuela Re | August 2, 2025 | ransomware_live | — |
| Oriental de Seguros | August 2, 2025 | ransomware_live | — |
| Shifa Oman | July 21, 2025 | ransomware_live | — |
| PC Chandra Jewellers | July 15, 2025 | ransomware_live | — |
| Takedown request #1798 | July 14, 2025 | ransomware_live | — |
| Algorithmica Research | July 13, 2025 | ransomware_live | — |
| AB Mauri Private | July 5, 2025 | ransomware_live | — |
| JN Aceros | June 30, 2025 | ransomware_live | — |
| Flexofast Indonesia | June 28, 2025 | ransomware_live | — |
| Kuwait Portland Cement | June 27, 2025 | ransomware_live | — |
| Wharton Independent | June 27, 2025 | ransomware_live | — |
| Grupo Halcon | June 27, 2025 | ransomware_live | — |
| Cremona Inoxidable | June 27, 2025 | ransomware_live | — |
| JIEI (Thailand) Co., Ltd | June 24, 2025 | ransomware_live | — |
| Surtel Technologies Pvt | February 19, 2025 | ransomware_live | — |
| Ophtazon | February 19, 2025 | ransomware_live | — |
| InjectSense | February 19, 2025 | ransomware_live | — |
| Del Campo Supreme | February 19, 2025 | ransomware_live | — |
| AUSA Soluciones Logisticas | February 19, 2025 | ransomware_live | — |
| Seguros la Cmara | February 19, 2025 | ransomware_live | — |
| Madagascar Airlines | February 19, 2025 | ransomware_live | — |
| Donacoop (VinaCapital) | February 19, 2025 | ransomware_live | — |
| DRD Communications | February 19, 2025 | ransomware_live | — |
| United Enterprise Fund | February 19, 2025 | ransomware_live | — |
| Colliers | February 19, 2025 | ransomware_live | — |
| Flavor Producers | February 19, 2025 | ransomware_live | — |
| HSR Specialist Researchers | February 19, 2025 | ransomware_live | — |
| BioNet-Asia | February 19, 2025 | ransomware_live | — |
| Hart | February 19, 2025 | ransomware_live | — |
| DTI Foreign Trade Service Corps | February 19, 2025 | ransomware_live | — |
| Hog Slat | February 19, 2025 | ransomware_live | — |
| Dekoyap | February 19, 2025 | ransomware_live | — |
| Pos Bilişim Teknolojileri | February 19, 2025 | ransomware_live | — |
| Rogers Capital | February 19, 2025 | ransomware_live | — |
| British School of Brasilia | February 19, 2025 | ransomware_live | — |
| BIB Insurance Brokers | February 19, 2025 | ransomware_live | — |
| Paltrack | February 19, 2025 | ransomware_live | — |
| CPF Financial Services | February 19, 2025 | ransomware_live | — |
| Abatix | February 19, 2025 | ransomware_live | — |
| Lawsoft | February 19, 2025 | ransomware_live | — |
| Seac | February 19, 2025 | ransomware_live | — |
| Universidade Federal de Sergipe | February 19, 2025 | ransomware_live | — |
| PT Pupuk Iskandar Muda | April 3, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).