thegentlemen
Also known as: Storm-2697First seen September 9, 2025Active1,002 claimed victims
The claims below are reproduced as posted by thegentlemen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Mdj Management | August 6, 2026 | ransomware_live | — |
| Vitex Pharmaceuticals | August 6, 2026 | ransomware_live | — |
| INKA Group GmbH Co | August 6, 2026 | ransomware_live | — |
| DHC | August 6, 2026 | ransomware_live | — |
| Control Concepts Technology | August 4, 2026 | ransomware_live | — |
| TopMark Funding | August 4, 2026 | ransomware_live | — |
| Philippine Savings Bank | August 1, 2026 | ransomware_live | — |
| Pertamina | July 31, 2026 | ransomware_live | — |
| Okovolt Solartechnik | July 31, 2026 | ransomware_live | — |
| Total Auto Business Solutions | July 31, 2026 | ransomware_live | — |
| Chemco Systems | July 31, 2026 | ransomware_live | — |
| World Wide Fittings | July 31, 2026 | ransomware_live | — |
| Municipalidad de San Luis | July 31, 2026 | ransomware_live | — |
| Peachtree Group | July 31, 2026 | ransomware_live | — |
| Known | July 31, 2026 | ransomware_live | — |
| Paula Fish | July 31, 2026 | ransomware_live | — |
| Amicell | July 31, 2026 | ransomware_live | — |
| Efrata College of Education | July 31, 2026 | ransomware_live | — |
| The Municipal Chamber of Serra | July 31, 2026 | ransomware_live | — |
| Orsima | July 31, 2026 | ransomware_live | — |
| Clear Vision Signs | July 31, 2026 | ransomware_live | — |
| Precision Concrete Pumping | July 31, 2026 | ransomware_live | — |
| Bater | July 31, 2026 | ransomware_live | — |
| Premier Fiduciary | July 31, 2026 | ransomware_live | — |
| Preferred | July 31, 2026 | ransomware_live | — |
| Partition Specialties | July 31, 2026 | ransomware_live | — |
| CRB group | July 31, 2026 | ransomware_live | — |
| Hutch Paving | July 31, 2026 | ransomware_live | — |
| OHK Energy | July 31, 2026 | ransomware_live | — |
| CFS | July 31, 2026 | ransomware_live | — |
| Acosta Sons | July 31, 2026 | ransomware_live | — |
| Saturn Industries | July 31, 2026 | ransomware_live | — |
| Kosh Innovations | July 31, 2026 | ransomware_live | — |
| Krafman | July 31, 2026 | ransomware_live | — |
| Salama Medicals Distributors Private | July 31, 2026 | ransomware_live | — |
| Salem Saleh Babgi | July 31, 2026 | ransomware_live | — |
| Additive Manufacturing | July 31, 2026 | ransomware_live | — |
| Kenaitze Indian Tribe | July 31, 2026 | ransomware_live | — |
| Las Cenizas | July 30, 2026 | ransomware_live | — |
| The Garfield County Sheriff Office | July 29, 2026 | ransomware_live | — |
| Angel Hotel | July 29, 2026 | ransomware_live | — |
| Indus Protech Solutions | July 29, 2026 | ransomware_live | — |
| Upanal CNC Solutions | July 29, 2026 | ransomware_live | — |
| Kontact Consortium India Pvt | July 29, 2026 | ransomware_live | — |
| ETA Technology Pvt | July 29, 2026 | ransomware_live | — |
| Delkart Industries Pvt | July 29, 2026 | ransomware_live | — |
| Malaysian Nuclear Agency | July 29, 2026 | ransomware_live | — |
| Promatrix | July 29, 2026 | ransomware_live | — |
| Buck Knives | July 28, 2026 | ransomware_live | — |
| Advanced Marketing | July 24, 2026 | ransomware_live | — |
| Wunschkind Klinik Dr Brunbauer | July 23, 2026 | ransomware_live | — |
| Conecsus | July 23, 2026 | ransomware_live | — |
| MatTek | July 23, 2026 | ransomware_live | — |
| Optiforms | July 23, 2026 | ransomware_live | — |
| vpcgroup.com customfoam.com | July 23, 2026 | ransomware_live | — |
| Herbahaz | July 23, 2026 | ransomware_live | — |
| Ceska filharmonie | July 23, 2026 | ransomware_live | — |
| Velum | July 23, 2026 | ransomware_live | — |
| Lenrose | July 23, 2026 | ransomware_live | — |
| Affinity Designs | July 23, 2026 | ransomware_live | — |
| DayNDay | July 23, 2026 | ransomware_live | — |
| SMRTR | July 23, 2026 | ransomware_live | — |
| Henry Frerk Sons | July 23, 2026 | ransomware_live | — |
| Raben Group | July 23, 2026 | ransomware_live | — |
| Agapit | July 23, 2026 | ransomware_live | — |
| HBS Group | July 23, 2026 | ransomware_live | — |
| Compagnie des Caoutchoucs du Pakidie | July 23, 2026 | ransomware_live | — |
| Gloria Maris Groupe | July 23, 2026 | ransomware_live | — |
| SICSOE | July 23, 2026 | ransomware_live | — |
| Clarke Radiology | July 23, 2026 | ransomware_live | — |
| Title Resources | July 23, 2026 | ransomware_live | — |
| Thialf | July 23, 2026 | ransomware_live | — |
| Decoupe Laser Services | July 23, 2026 | ransomware_live | — |
| Oldelval Oleoductos del Valle | July 23, 2026 | ransomware_live | — |
| TC Printing | July 23, 2026 | ransomware_live | — |
| Tikona Infinet | July 23, 2026 | ransomware_live | — |
| GUERREIROS seguros | July 23, 2026 | ransomware_live | — |
| MK Jewelry | July 23, 2026 | ransomware_live | — |
| European Design | July 23, 2026 | ransomware_live | — |
| Sirl | July 20, 2026 | ransomware_live | — |
| Sunway Scientific | July 17, 2026 | ransomware_live | — |
| Advantage Home Health Care | July 17, 2026 | ransomware_live | — |
| Military Sealift Command | July 17, 2026 | ransomware_live | — |
| Terry P Moosmann CPA PC | July 16, 2026 | ransomware_live | — |
| Byggelit Sverige | July 16, 2026 | ransomware_live | — |
| Kaneko | July 16, 2026 | ransomware_live | — |
| Mesto Celakovice | July 16, 2026 | ransomware_live | — |
| Giraudi Group | July 16, 2026 | ransomware_live | — |
| Lsn | July 16, 2026 | ransomware_live | — |
| Dink Co Ltd | July 16, 2026 | ransomware_live | — |
| Vignobles Toutigeac | July 16, 2026 | ransomware_live | — |
| Terra Vitis | July 16, 2026 | ransomware_live | — |
| Tooltec | July 16, 2026 | ransomware_live | — |
| ALUFE Femszerkezeti Kft | July 16, 2026 | ransomware_live | — |
| Landesbibliothek Coburg | July 16, 2026 | ransomware_live | — |
| Comet Enterprise Corp | July 16, 2026 | ransomware_live | — |
| Metro Mondego | July 16, 2026 | ransomware_live | — |
| Hanseata | July 16, 2026 | ransomware_live | — |
| Gallant | July 16, 2026 | ransomware_live | — |
| Customs Watch | July 16, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).