thegentlemen
Also known as: Storm-2697First seen September 9, 2025Active1,002 claimed victims
The claims below are reproduced as posted by thegentlemen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| BRAC | July 14, 2026 | ransomware_live | — |
| Tangram Interiors | July 13, 2026 | ransomware_live | — |
| Dash Door Glass | July 10, 2026 | ransomware_live | — |
| Carita | July 10, 2026 | ransomware_live | — |
| Lopes Law | July 10, 2026 | ransomware_live | — |
| Gene Codes Forensics | July 10, 2026 | ransomware_live | — |
| VASBE | July 10, 2026 | ransomware_live | — |
| Welders Supply Equipment Rentals | July 10, 2026 | ransomware_live | — |
| Pharma Wholesale | July 10, 2026 | ransomware_live | — |
| Crossroads Medical Management | July 10, 2026 | ransomware_live | — |
| INTERNET AG | July 10, 2026 | ransomware_live | — |
| Open Options | July 10, 2026 | ransomware_live | — |
| Energon | July 10, 2026 | ransomware_live | — |
| Vicenzi Group | July 10, 2026 | ransomware_live | — |
| Triquesta | July 10, 2026 | ransomware_live | — |
| Aveiro Constructors Limited | July 10, 2026 | ransomware_live | — |
| Martin Cava | July 10, 2026 | ransomware_live | — |
| Fortray | July 10, 2026 | ransomware_live | — |
| Ferretería Scopazzo | July 10, 2026 | ransomware_live | — |
| Ecopetrol | July 9, 2026 | ransomware_live | — |
| Technical Solutions Group | July 6, 2026 | ransomware_live | — |
| Pro-Tech Technology | July 6, 2026 | ransomware_live | — |
| MBT Energy | July 6, 2026 | ransomware_live | — |
| Jump Solutions Inc | July 6, 2026 | ransomware_live | — |
| CSIR Structural Engineering Research Centre | July 6, 2026 | ransomware_live | — |
| Mercado Libre | July 6, 2026 | ransomware_live | — |
| Excel Cell Electronic | July 6, 2026 | ransomware_live | — |
| Automovil Supply S.A | July 6, 2026 | ransomware_live | — |
| Tonnies Group | July 6, 2026 | ransomware_live | — |
| EBNY Development | July 6, 2026 | ransomware_live | — |
| Kosmos | July 6, 2026 | ransomware_live | — |
| Keifert | July 6, 2026 | ransomware_live | — |
| Ce Ratp Comite D entreprise Ratp | July 6, 2026 | ransomware_live | — |
| Arabia Falcon Insurance Company SAOG | July 6, 2026 | ransomware_live | — |
| hiddeenn | July 6, 2026 | ransomware_live | — |
| Spedidam | July 6, 2026 | ransomware_live | — |
| Quanterm Logistics Sdn Bhd | July 6, 2026 | ransomware_live | — |
| Virginia Historical Society | July 6, 2026 | ransomware_live | — |
| LogiQuip | July 6, 2026 | ransomware_live | — |
| Royal Foods | July 6, 2026 | ransomware_live | — |
| Medic Rescue | July 4, 2026 | ransomware_live | — |
| Shamrock Holdings Inc. | July 2, 2026 | ransomware_live | — |
| Pou Sheng International | June 30, 2026 | ransomware_live | — |
| SDEZ | June 30, 2026 | ransomware_live | — |
| FAC Logistique | June 30, 2026 | ransomware_live | — |
| Melcor Developments Ltd | June 30, 2026 | ransomware_live | — |
| CUI Agency | June 30, 2026 | ransomware_live | — |
| Wacha Justen | June 30, 2026 | ransomware_live | — |
| Oron Law Firm | June 30, 2026 | ransomware_live | — |
| The City of Boyne City | June 30, 2026 | ransomware_live | — |
| EMAS Group | June 30, 2026 | ransomware_live | — |
| MakoLab | June 30, 2026 | ransomware_live | — |
| NATURGHIACCIO | June 30, 2026 | ransomware_live | — |
| OSP HOLDING FRANCE | June 30, 2026 | ransomware_live | — |
| Mondottica | June 30, 2026 | ransomware_live | — |
| Comp Trading Co | June 30, 2026 | ransomware_live | — |
| Centre Ophtalmologique dErmont | June 30, 2026 | ransomware_live | — |
| Climax Technology | June 30, 2026 | ransomware_live | — |
| Indra Group | June 30, 2026 | ransomware_live | — |
| Steegaa Interior | June 30, 2026 | ransomware_live | — |
| DHC Corporation | June 30, 2026 | ransomware_live | — |
| Immling | June 30, 2026 | ransomware_live | — |
| Ayres Carr & Sullivan, P.C. | June 27, 2026 | ransomware_live | — |
| Disney Family | June 26, 2026 | ransomware_live | — |
| Thyssenkrupp Marine Systems (TKMS) GmbH / Atlas Elektronik | June 25, 2026 | ransomware_live | — |
| Au Vieux Campeur | June 24, 2026 | ransomware_live | — |
| Natren | June 24, 2026 | ransomware_live | — |
| CHIFENG GOLD SEPON | June 24, 2026 | ransomware_live | — |
| Bell Hardware | June 24, 2026 | ransomware_live | — |
| Gegenbauer Elektrotechnik | June 24, 2026 | ransomware_live | — |
| Stadttheater Giessen | June 24, 2026 | ransomware_live | — |
| BDS CZ | June 24, 2026 | ransomware_live | — |
| Beran Concrete | June 24, 2026 | ransomware_live | — |
| Al Dhow Group | June 24, 2026 | ransomware_live | — |
| Meccanica Gn | June 24, 2026 | ransomware_live | — |
| MBO GmbH | June 22, 2026 | ransomware_live | — |
| ErgoMed | June 22, 2026 | ransomware_live | — |
| Canada Wide Media | June 22, 2026 | ransomware_live | — |
| Rowley Properties | June 22, 2026 | ransomware_live | — |
| GIA Partners | June 22, 2026 | ransomware_live | — |
| Hooke Laboratories | June 22, 2026 | ransomware_live | — |
| CTM India Limited motherson INDIA | June 22, 2026 | ransomware_live | — |
| Royal Thai Navy Housing Cooperative | June 22, 2026 | ransomware_live | — |
| International Freight Services | June 22, 2026 | ransomware_live | — |
| Keywest Projects | June 22, 2026 | ransomware_live | — |
| Athens Orthopedic Clinic | June 19, 2026 | ransomware_live | — |
| hiddenn | June 19, 2026 | ransomware_live | — |
| Al Khaja Holding | June 18, 2026 | ransomware_live | — |
| Cofaq | June 18, 2026 | ransomware_live | — |
| Sertrans | June 18, 2026 | ransomware_live | — |
| Burris MacOmber | June 18, 2026 | ransomware_live | — |
| Yudu Technology | June 18, 2026 | ransomware_live | — |
| Amigest | June 18, 2026 | ransomware_live | — |
| Ty Thac Co | June 18, 2026 | ransomware_live | — |
| TERRIO Therapy Fitness | June 18, 2026 | ransomware_live | — |
| SGS Malaysia | June 18, 2026 | ransomware_live | — |
| Alexander Buch Bilanzbuchhalter | June 18, 2026 | ransomware_live | — |
| Vera Chimie Management | June 18, 2026 | ransomware_live | — |
| Buechel Stone | June 15, 2026 | ransomware_live | — |
| Maine Oxy | June 15, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).