thegentlemen
Also known as: Storm-2697First seen September 9, 2025Active816 claimed victims
The claims below are reproduced as posted by thegentlemen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| hiddenn | June 19, 2026 | ransomware_live | — |
| Al Khaja Holding | June 18, 2026 | ransomware_live | — |
| Cofaq | June 18, 2026 | ransomware_live | — |
| Sertrans | June 18, 2026 | ransomware_live | — |
| Burris MacOmber | June 18, 2026 | ransomware_live | — |
| Yudu Technology | June 18, 2026 | ransomware_live | — |
| Amigest | June 18, 2026 | ransomware_live | — |
| Ty Thac Co | June 18, 2026 | ransomware_live | — |
| TERRIO Therapy Fitness | June 18, 2026 | ransomware_live | — |
| SGS Malaysia | June 18, 2026 | ransomware_live | — |
| Alexander Buch Bilanzbuchhalter | June 18, 2026 | ransomware_live | — |
| Vera Chimie Management | June 18, 2026 | ransomware_live | — |
| Buechel Stone | June 15, 2026 | ransomware_live | — |
| Maine Oxy | June 15, 2026 | ransomware_live | — |
| Cole Manufacturing | June 15, 2026 | ransomware_live | — |
| Kozminski University | June 15, 2026 | ransomware_live | — |
| Constructions Piraino | June 15, 2026 | ransomware_live | — |
| Fecovita | June 15, 2026 | ransomware_live | — |
| Traublinger | June 15, 2026 | ransomware_live | — |
| Times Software | June 15, 2026 | ransomware_live | — |
| National Museum | June 15, 2026 | ransomware_live | — |
| Buratti | June 15, 2026 | ransomware_live | — |
| SigmaControl | June 15, 2026 | ransomware_live | — |
| Mackay Sugar | June 15, 2026 | ransomware_live | — |
| Executive Coach | June 15, 2026 | ransomware_live | — |
| Centre Medical Crowley | June 15, 2026 | ransomware_live | — |
| Linnecken Partner | June 15, 2026 | ransomware_live | — |
| Palmer Sicard | June 15, 2026 | ransomware_live | — |
| Ministarstvo zdravstva Republike Hrvatske | June 15, 2026 | ransomware_live | — |
| Calipage Humblet | June 15, 2026 | ransomware_live | — |
| Mahajak Development | June 15, 2026 | ransomware_live | — |
| South Texas Spinal Clinic | June 15, 2026 | ransomware_live | — |
| Enciso Ltda | June 15, 2026 | ransomware_live | — |
| Allensbach Volunteer | June 10, 2026 | ransomware_live | — |
| Tokabei Japan | June 10, 2026 | ransomware_live | — |
| Silmquinas e Equipamentos | June 10, 2026 | ransomware_live | — |
| Scenic Hudson | June 10, 2026 | ransomware_live | — |
| UiTM Holdings | June 10, 2026 | ransomware_live | — |
| WCM Remedium | June 8, 2026 | ransomware_live | — |
| Danzo Group | June 8, 2026 | ransomware_live | — |
| Goldlion | June 8, 2026 | ransomware_live | — |
| Yao Yuan Technology | June 8, 2026 | ransomware_live | — |
| Integrated Distribution | June 8, 2026 | ransomware_live | — |
| The Clinic | June 8, 2026 | ransomware_live | — |
| FESCO Adecco | June 8, 2026 | ransomware_live | — |
| Trigon America | June 8, 2026 | ransomware_live | — |
| Jyharn Electronic | June 8, 2026 | ransomware_live | — |
| Empty | June 8, 2026 | ransomware_live | — |
| Institucion Cervantes | June 8, 2026 | ransomware_live | — |
| Tress | June 8, 2026 | ransomware_live | — |
| Metroply | June 8, 2026 | ransomware_live | — |
| Central Arkansas Pediatrics | June 8, 2026 | ransomware_live | — |
| IP Rings | June 8, 2026 | ransomware_live | — |
| Michigan Surgical Center | June 3, 2026 | ransomware_live | — |
| Thoresen Thai Agencies | June 3, 2026 | ransomware_live | — |
| Edgewood Surgical Hospital | June 3, 2026 | ransomware_live | — |
| Kunal Enterprises | June 3, 2026 | ransomware_live | — |
| 3E Accounting | June 3, 2026 | ransomware_live | — |
| Liztex Guatemala | June 3, 2026 | ransomware_live | — |
| TeLoh | June 3, 2026 | ransomware_live | — |
| Soja de Portugal | June 3, 2026 | ransomware_live | — |
| Downriver Medical Associates | June 3, 2026 | ransomware_live | — |
| Suburban Water | June 1, 2026 | ransomware_live | — |
| Soniva Dental | June 1, 2026 | ransomware_live | — |
| National Industries | June 1, 2026 | ransomware_live | — |
| Bouri Group | June 1, 2026 | ransomware_live | — |
| Computime Group | June 1, 2026 | ransomware_live | — |
| Harrell Martin Peace | June 1, 2026 | ransomware_live | — |
| Brian Jessel BMW | June 1, 2026 | ransomware_live | — |
| Fibrenoire | June 1, 2026 | ransomware_live | — |
| Smile Siam Printing Service | June 1, 2026 | ransomware_live | — |
| Arabian Procession Holding | June 1, 2026 | ransomware_live | — |
| Anandji Haridas | June 1, 2026 | ransomware_live | — |
| M Rocha J Serra Lda | June 1, 2026 | ransomware_live | — |
| Corporacion Prokompra | May 28, 2026 | ransomware_live | — |
| Heartland Growers | May 28, 2026 | ransomware_live | — |
| Fonderia Corra | May 28, 2026 | ransomware_live | — |
| Grupo Premier | May 28, 2026 | ransomware_live | — |
| Techmar | May 26, 2026 | ransomware_live | — |
| Mayelia Automotive | May 26, 2026 | ransomware_live | — |
| Openmind Networks | May 24, 2026 | ransomware_live | — |
| Koa Glass | May 24, 2026 | ransomware_live | — |
| ACAM Systemautomation | May 24, 2026 | ransomware_live | — |
| TRANSSYSTEM Group | May 24, 2026 | ransomware_live | — |
| Caka Grup Lojistik | May 24, 2026 | ransomware_live | — |
| Hussey Seatway | May 24, 2026 | ransomware_live | — |
| Sanatorio Delta | May 24, 2026 | ransomware_live | — |
| Le Perreux sur Marne | May 24, 2026 | ransomware_live | — |
| Seeley Office Systems | May 24, 2026 | ransomware_live | — |
| YMCA of Columbia | May 21, 2026 | ransomware_live | — |
| MBM Corp | May 21, 2026 | ransomware_live | — |
| Grupo Pasquel | May 21, 2026 | ransomware_live | — |
| University of Finance and Administration | May 18, 2026 | ransomware_live | — |
| Modern Display | May 18, 2026 | ransomware_live | — |
| DEVO-Tech | May 18, 2026 | ransomware_live | — |
| E-Control Systems | May 18, 2026 | ransomware_live | — |
| Internet Technologies Designs | May 18, 2026 | ransomware_live | — |
| Polyrack | May 18, 2026 | ransomware_live | — |
| Internal Medicine | May 18, 2026 | ransomware_live | — |
| Ross Yerger Insurance | May 15, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).