thegentlemen
Also known as: Storm-2697First seen September 9, 2025Active1,002 claimed victims
The claims below are reproduced as posted by thegentlemen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Nutrypollo | August 28, 2026 | ransomware_live | — |
| ESB Puerto Rico Corp | August 28, 2026 | ransomware_live | — |
| Adkisson Group | August 28, 2026 | ransomware_live | — |
| Thai Film Industries PCL | August 28, 2026 | ransomware_live | — |
| SUNSEA | August 28, 2026 | ransomware_live | — |
| Probe Test System | August 28, 2026 | ransomware_live | — |
| Tecno Accion | August 28, 2026 | ransomware_live | — |
| Ixa Systems | August 28, 2026 | ransomware_live | — |
| General Gruppo | August 28, 2026 | ransomware_live | — |
| Northwest Trophy | August 28, 2026 | ransomware_live | — |
| G R Infraprojects | August 28, 2026 | ransomware_live | — |
| Glassdoor | August 28, 2026 | ransomware_live | — |
| Incolur | August 26, 2026 | ransomware_live | — |
| Espinos | August 26, 2026 | ransomware_live | — |
| Verbux | August 25, 2026 | ransomware_live | — |
| TEC Container | August 25, 2026 | ransomware_live | — |
| Party Rental | August 25, 2026 | ransomware_live | — |
| Meridian Logistics Group | August 22, 2026 | ransomware_live | — |
| Ariel Energia | August 21, 2026 | ransomware_live | — |
| Oceanica Internacional | August 21, 2026 | ransomware_live | — |
| CAZ Investments | August 21, 2026 | ransomware_live | — |
| Aquasea | August 21, 2026 | ransomware_live | — |
| ARBEITERKAMMERN | August 21, 2026 | ransomware_live | — |
| Geb Sas | August 21, 2026 | ransomware_live | — |
| Almeer | August 21, 2026 | ransomware_live | — |
| ESCON Group | August 21, 2026 | ransomware_live | — |
| Akatake Engineering | August 21, 2026 | ransomware_live | — |
| Magdalena Grand Beach Golf Resort | August 21, 2026 | ransomware_live | — |
| LOG Systems | August 21, 2026 | ransomware_live | — |
| Lexacaucho | August 21, 2026 | ransomware_live | — |
| AWJ Holding | August 21, 2026 | ransomware_live | — |
| dlp motive | August 21, 2026 | ransomware_live | — |
| UOLconsult | August 21, 2026 | ransomware_live | — |
| Volktek | August 21, 2026 | ransomware_live | — |
| Layher | August 21, 2026 | ransomware_live | — |
| Espac | August 21, 2026 | ransomware_live | — |
| Gould Sherwood Consulting | August 21, 2026 | ransomware_live | — |
| Eyecare Center of Snohomish | August 21, 2026 | ransomware_live | — |
| AGS Cinemas | August 21, 2026 | ransomware_live | — |
| P**** R***** | August 20, 2026 | ransomware_live | — |
| Babcock | August 19, 2026 | ransomware_live | — |
| Roadvision Systems | August 18, 2026 | ransomware_live | — |
| Senvest Capital | August 18, 2026 | ransomware_live | — |
| CRASL | August 18, 2026 | ransomware_live | — |
| Euroscreen | August 17, 2026 | ransomware_live | — |
| Vector Two Technology | August 14, 2026 | ransomware_live | — |
| Acli | August 14, 2026 | ransomware_live | — |
| Community Connections | August 14, 2026 | ransomware_live | — |
| Megalaser Industria Metalurgica LTDA | August 14, 2026 | ransomware_live | — |
| EKEPIS | August 14, 2026 | ransomware_live | — |
| Avanta Maroc Ex Adecco | August 14, 2026 | ransomware_live | — |
| Plaza Auto Mall | August 14, 2026 | ransomware_live | — |
| Tempel | August 14, 2026 | ransomware_live | — |
| TOA | August 14, 2026 | ransomware_live | — |
| Retail Business Management Systems | August 14, 2026 | ransomware_live | — |
| Cityside Homes | August 14, 2026 | ransomware_live | — |
| First Coast Heart Vascular Center | August 14, 2026 | ransomware_live | — |
| KFC Kosova | August 14, 2026 | ransomware_live | — |
| The Coffee Bean | August 14, 2026 | ransomware_live | — |
| Ollies Place Kidswear | August 14, 2026 | ransomware_live | — |
| Gravity Coffee | August 14, 2026 | ransomware_live | — |
| Gfeller Treuhand und Verwaltungs | August 13, 2026 | ransomware_live | — |
| IPS | August 13, 2026 | ransomware_live | — |
| Safeware | August 12, 2026 | ransomware_live | — |
| Zion Contracting | August 10, 2026 | ransomware_live | — |
| Premier Pigs | August 9, 2026 | ransomware_live | — |
| Eva Care | August 9, 2026 | ransomware_live | — |
| Hong Kong Baptist University | August 9, 2026 | ransomware_live | — |
| Mikel Coffee | August 9, 2026 | ransomware_live | — |
| Canopy Support Services | August 9, 2026 | ransomware_live | — |
| NTU Alumni Club | August 9, 2026 | ransomware_live | — |
| AnMed | August 9, 2026 | ransomware_live | — |
| AIMS Group | August 9, 2026 | ransomware_live | — |
| Lancesoft India | August 9, 2026 | ransomware_live | — |
| RAK Construction | August 9, 2026 | ransomware_live | — |
| CONTAC Ingenieros | August 9, 2026 | ransomware_live | — |
| PharmaEssentia | August 9, 2026 | ransomware_live | — |
| BioPharma | August 9, 2026 | ransomware_live | — |
| Zion Construction | August 9, 2026 | ransomware_live | — |
| Hartfiel Automation | August 7, 2026 | ransomware_live | — |
| YY Business Solutions | August 6, 2026 | ransomware_live | — |
| Halliday Watkins Mann | August 6, 2026 | ransomware_live | — |
| ZS Salovnova | August 6, 2026 | ransomware_live | — |
| Holborn European Marketing | August 6, 2026 | ransomware_live | — |
| Phase Technologies | August 6, 2026 | ransomware_live | — |
| LensAss Architecten | August 6, 2026 | ransomware_live | — |
| Vemec | August 6, 2026 | ransomware_live | — |
| Nobema | August 6, 2026 | ransomware_live | — |
| Feraboli Zootech | August 6, 2026 | ransomware_live | — |
| Intranet Gov Brasil | August 6, 2026 | ransomware_live | — |
| TESI | August 6, 2026 | ransomware_live | — |
| National Furniture Outlet | August 6, 2026 | ransomware_live | — |
| HIWIN | August 6, 2026 | ransomware_live | — |
| aZaaS | August 6, 2026 | ransomware_live | — |
| Hoang Chiropractic Center | August 6, 2026 | ransomware_live | — |
| Godollo | August 6, 2026 | ransomware_live | — |
| Ponti | August 6, 2026 | ransomware_live | — |
| Axson Teknik | August 6, 2026 | ransomware_live | — |
| Groupe BPCE | August 6, 2026 | ransomware_live | — |
| Hst | August 6, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).