thegentlemen
Also known as: Storm-2697First seen September 9, 2025Active1,002 claimed victims
The claims below are reproduced as posted by thegentlemen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Drinks Wines Spirits | September 29, 2026 | ransomware_live | — |
| Groupe APROSEP | September 29, 2026 | ransomware_live | — |
| Telrad Networks | September 29, 2026 | ransomware_live | — |
| Europrim | September 29, 2026 | ransomware_live | — |
| QUALITY SPORT Topsport Italia | September 29, 2026 | ransomware_live | — |
| Auren | September 29, 2026 | ransomware_live | — |
| Solaria | September 29, 2026 | ransomware_live | — |
| Webb Electric Company of Florida | September 29, 2026 | ransomware_live | — |
| Datacomm Services | September 29, 2026 | ransomware_live | — |
| Defencebit | September 29, 2026 | ransomware_live | — |
| Edcon | September 29, 2026 | ransomware_live | — |
| Samwumed | September 29, 2026 | ransomware_live | — |
| LegalWise | September 29, 2026 | ransomware_live | — |
| FTAPI Software | September 25, 2026 | ransomware_live | — |
| ENKEI******* | September 24, 2026 | ransomware_live | — |
| Charles Keith | September 24, 2026 | ransomware_live | — |
| Ligue se Grupo | September 24, 2026 | ransomware_live | — |
| DW McMillan Memorial Hospital | September 21, 2026 | ransomware_live | — |
| Pajulahti | September 21, 2026 | ransomware_live | — |
| Crystal Glass | September 21, 2026 | ransomware_live | — |
| Craisa | September 21, 2026 | ransomware_live | — |
| Brancoptica | September 21, 2026 | ransomware_live | — |
| PuroClean | September 21, 2026 | ransomware_live | — |
| Trifecta Software | September 21, 2026 | ransomware_live | — |
| Markisol | September 21, 2026 | ransomware_live | — |
| Agrocampo | September 21, 2026 | ransomware_live | — |
| Grupo MARSAN | September 21, 2026 | ransomware_live | — |
| Progeny | September 21, 2026 | ransomware_live | — |
| ANP Health | September 21, 2026 | ransomware_live | — |
| Magnetos y Refacciones | September 21, 2026 | ransomware_live | — |
| Hell Helmut GmbH | September 21, 2026 | ransomware_live | — |
| StMicroelectronics | September 21, 2026 | ransomware_live | — |
| Metalware Corporation | September 21, 2026 | ransomware_live | — |
| Guardrisk | September 21, 2026 | ransomware_live | — |
| Grupolider | September 21, 2026 | ransomware_live | — |
| MedSkin Solutions Dr. Suwelack AG | September 14, 2026 | ransomware_live | — |
| TMI Tecnicas Mecanicas Ilerdenses | September 14, 2026 | ransomware_live | — |
| Sarku Japan | September 14, 2026 | ransomware_live | — |
| Librería Santa Fe | September 14, 2026 | ransomware_live | — |
| Apteki Mareshki | September 14, 2026 | ransomware_live | — |
| Aforpa | September 14, 2026 | ransomware_live | — |
| Wada Farms | September 14, 2026 | ransomware_live | — |
| Somit | September 14, 2026 | ransomware_live | — |
| Multipla Contabilidade Empresarial | September 14, 2026 | ransomware_live | — |
| Technical Asia | September 14, 2026 | ransomware_live | — |
| Ardom Eilot | September 14, 2026 | ransomware_live | — |
| BGR Energy Systems | September 14, 2026 | ransomware_live | — |
| Dang Invest Group | September 14, 2026 | ransomware_live | — |
| Dome Gold Mines | September 14, 2026 | ransomware_live | — |
| Tentac | September 14, 2026 | ransomware_live | — |
| High Oakham Primary School | September 14, 2026 | ransomware_live | — |
| Humboldt | September 14, 2026 | ransomware_live | — |
| Iveta | September 14, 2026 | ransomware_live | — |
| Neff Drexel | September 14, 2026 | ransomware_live | — |
| Downrite Engineering | September 14, 2026 | ransomware_live | — |
| Agenzia Vittoria Assicurazioni | September 14, 2026 | ransomware_live | — |
| Cedars Foods | September 14, 2026 | ransomware_live | — |
| Balkan Polymers | September 14, 2026 | ransomware_live | — |
| Gelarti | September 14, 2026 | ransomware_live | — |
| Alchin Long Group | September 14, 2026 | ransomware_live | — |
| Goteborgsregionens Tekniska Gymnasium | September 14, 2026 | ransomware_live | — |
| Aurora Technologies | September 14, 2026 | ransomware_live | — |
| Indic | September 14, 2026 | ransomware_live | — |
| Hattiesburg Eye Clinic | September 14, 2026 | ransomware_live | — |
| ACA Pescara | September 14, 2026 | ransomware_live | — |
| Air Canada | September 9, 2026 | ransomware_live | — |
| PharmaEssentia Corporation | September 9, 2026 | ransomware_live | — |
| Superstore | September 7, 2026 | ransomware_live | — |
| El Carriel | September 7, 2026 | ransomware_live | — |
| AbacoViaggi | September 7, 2026 | ransomware_live | — |
| Comin Sac | September 7, 2026 | ransomware_live | — |
| Ritz Safety | September 7, 2026 | ransomware_live | — |
| Biotipo Jeans | September 7, 2026 | ransomware_live | — |
| Metro | September 7, 2026 | ransomware_live | — |
| Domis | September 7, 2026 | ransomware_live | — |
| Zanini | September 7, 2026 | ransomware_live | — |
| Soni Dwarkadas Virchand | September 7, 2026 | ransomware_live | — |
| Yapı Merkezi | September 7, 2026 | ransomware_live | — |
| S A Chile | September 7, 2026 | ransomware_live | — |
| Sharp Office | September 7, 2026 | ransomware_live | — |
| Chip7 | September 7, 2026 | ransomware_live | — |
| Nile Projects Trading | September 7, 2026 | ransomware_live | — |
| University of San Francisco | September 7, 2026 | ransomware_live | — |
| Mutant | September 7, 2026 | ransomware_live | — |
| Drogueria Saporiti Sacifia | September 7, 2026 | ransomware_live | — |
| Hollard Insurance Group | September 7, 2026 | ransomware_live | — |
| Lider Aviacao | September 5, 2026 | ransomware_live | — |
| Veradigm | September 4, 2026 | ransomware_live | reported in press coverage |
| Zdrowit | September 4, 2026 | ransomware_live | — |
| Leo Schachter Diamonds | September 2, 2026 | ransomware_live | — |
| Seasia Infotech | September 1, 2026 | ransomware_live | — |
| The Sole | August 31, 2026 | ransomware_live | — |
| Nutex Health | August 31, 2026 | ransomware_live | reported in press coverage |
| CareerSource Palm Beach County | August 31, 2026 | ransomware_live | — |
| Saudi Consulting Services SAUD CONSULT | August 31, 2026 | ransomware_live | — |
| EP Manufacturing Bhd | August 31, 2026 | ransomware_live | — |
| Servicios Aereos Estrella | August 28, 2026 | ransomware_live | — |
| Exacta Optech Labcenter | August 28, 2026 | ransomware_live | — |
| MB Associates | August 28, 2026 | ransomware_live | — |
| Brebur | August 28, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).