thegentlemen
Also known as: Storm-2697First seen September 9, 2025Active816 claimed victims
The claims below are reproduced as posted by thegentlemen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Digiprint | May 14, 2026 | ransomware_live | — |
| Ponisch Abogados | May 14, 2026 | ransomware_live | — |
| Grupo Alvorada | May 14, 2026 | ransomware_live | — |
| Instituut voor de Nederlandse | May 14, 2026 | ransomware_live | — |
| GeTeCe | May 12, 2026 | ransomware_live | — |
| Amstel Securities | May 12, 2026 | ransomware_live | — |
| Dodson & Horrell | May 12, 2026 | ransomware_live | — |
| Value Exchange International | May 12, 2026 | ransomware_live | — |
| SETCAR | May 12, 2026 | ransomware_live | — |
| Oriental Diamond | May 12, 2026 | ransomware_live | — |
| Electroban SAE | May 12, 2026 | ransomware_live | — |
| Qatar National Broadband | May 12, 2026 | ransomware_live | — |
| Shajarpak Securities | May 12, 2026 | ransomware_live | — |
| Focus Design Partners | May 12, 2026 | ransomware_live | — |
| Misr Chemical Industries | May 8, 2026 | ransomware_live | — |
| TDS | May 8, 2026 | ransomware_live | — |
| KUPER | May 8, 2026 | ransomware_live | — |
| VeriCon | May 8, 2026 | ransomware_live | — |
| McCarthy | May 8, 2026 | ransomware_live | — |
| Arizona Professional Painting | May 8, 2026 | ransomware_live | — |
| CHX Express | May 8, 2026 | ransomware_live | — |
| DEVCO | May 8, 2026 | ransomware_live | — |
| Hillside Lumber | May 8, 2026 | ransomware_live | — |
| DermaPharm | May 8, 2026 | ransomware_live | — |
| Mundo Amtae | May 6, 2026 | ransomware_live | — |
| Worralls | May 6, 2026 | ransomware_live | — |
| Manhattan Fire Safety Corp | May 6, 2026 | ransomware_live | — |
| Clark Fixture Technologies | May 6, 2026 | ransomware_live | — |
| FMS | May 6, 2026 | ransomware_live | — |
| C2O Architects | May 6, 2026 | ransomware_live | — |
| DATAMATIC | May 6, 2026 | ransomware_live | — |
| Gator Cases | May 6, 2026 | ransomware_live | — |
| IPE | May 6, 2026 | ransomware_live | — |
| Riggotts | May 6, 2026 | ransomware_live | — |
| Da Guan Technology | May 6, 2026 | ransomware_live | — |
| Nrt India | May 6, 2026 | ransomware_live | — |
| Farmers Association of Iceland | May 3, 2026 | ransomware_live | — |
| La Kaffa International | May 3, 2026 | ransomware_live | — |
| Mediaplex | May 3, 2026 | ransomware_live | — |
| Marutake | May 3, 2026 | ransomware_live | — |
| Kasapreko | May 3, 2026 | ransomware_live | — |
| Levante Living | May 3, 2026 | ransomware_live | — |
| Ontario Physiotherapy Association | May 3, 2026 | ransomware_live | — |
| Millennium Partners | May 3, 2026 | ransomware_live | — |
| East | May 3, 2026 | ransomware_live | — |
| The Modern Flour Mill | May 3, 2026 | ransomware_live | — |
| Engineered Advantage | May 3, 2026 | ransomware_live | — |
| Triquim | May 3, 2026 | ransomware_live | — |
| Keretapi Tanah | May 3, 2026 | ransomware_live | — |
| Media Consulting | May 3, 2026 | ransomware_live | — |
| Arcelik | May 1, 2026 | ransomware_live | — |
| Diviso Grupo Financiero | April 29, 2026 | ransomware_live | — |
| Kınık Gross | April 29, 2026 | ransomware_live | — |
| Magisterial Service | April 29, 2026 | ransomware_live | — |
| Forsheda Stlverktyg | April 29, 2026 | ransomware_live | — |
| Fabritius | April 29, 2026 | ransomware_live | — |
| ACFA Regionale de Calgary | April 27, 2026 | ransomware_live | — |
| Beaconhouse School System | April 27, 2026 | ransomware_live | — |
| Colegio Notre Dame Campinas | April 27, 2026 | ransomware_live | — |
| IT Management | April 27, 2026 | ransomware_live | — |
| MIMS | April 27, 2026 | ransomware_live | — |
| Nostrum | April 27, 2026 | ransomware_live | — |
| Heinrich Kopp | April 27, 2026 | ransomware_live | — |
| Lawson Software | April 26, 2026 | ransomware_live | — |
| Coralina | April 26, 2026 | ransomware_live | — |
| EEC Group | April 26, 2026 | ransomware_live | — |
| Champion Homes | April 21, 2026 | ransomware_live | — |
| Uniview Technologies | April 20, 2026 | ransomware_live | — |
| Euro Creations | April 20, 2026 | ransomware_live | — |
| SmartSystems | April 20, 2026 | ransomware_live | — |
| The Marton Agency | April 19, 2026 | ransomware_live | — |
| Teleos Systems | April 19, 2026 | ransomware_live | — |
| Anderlues | April 19, 2026 | ransomware_live | — |
| Suma Sklep | April 19, 2026 | ransomware_live | — |
| Jean Cultural | April 19, 2026 | ransomware_live | — |
| Philip Lee | April 19, 2026 | ransomware_live | — |
| Jumbo Transport | April 19, 2026 | ransomware_live | — |
| Laboratório Santa Luzia | April 19, 2026 | ransomware_live | — |
| Bmtp | April 19, 2026 | ransomware_live | — |
| El Ordeno | April 15, 2026 | ransomware_live | — |
| Marchesi di Barolo | April 15, 2026 | ransomware_live | — |
| IC Partners | April 15, 2026 | ransomware_live | — |
| Disk Precision | April 15, 2026 | ransomware_live | — |
| Greenpharma | April 15, 2026 | ransomware_live | — |
| ******.*** | April 14, 2026 | ransomware_live | — |
| Caja De Seguro Social | April 14, 2026 | ransomware_live | — |
| Hangzhou Industrial | April 14, 2026 | ransomware_live | — |
| Verzinkerei Rentrop | April 14, 2026 | ransomware_live | — |
| NSOFT | April 14, 2026 | ransomware_live | — |
| BRC Biotechnology | April 14, 2026 | ransomware_live | — |
| Double C Farm | April 14, 2026 | ransomware_live | — |
| International Maritime Hospita | April 14, 2026 | ransomware_live | — |
| Harlem Stage | April 14, 2026 | ransomware_live | — |
| Cleor | April 14, 2026 | ransomware_live | — |
| Brand Collective | April 14, 2026 | ransomware_live | — |
| GEM Terminal | April 14, 2026 | ransomware_live | — |
| Intra | April 14, 2026 | ransomware_live | — |
| UK Electronics | April 14, 2026 | ransomware_live | — |
| PsychPlus | April 14, 2026 | ransomware_live | — |
| EMCO Holding | April 8, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).