thegentlemen
Also known as: Storm-2697First seen September 9, 2025Active1,002 claimed victims
The claims below are reproduced as posted by thegentlemen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Misr Chemical Industries | May 8, 2026 | ransomware_live | — |
| TDS | May 8, 2026 | ransomware_live | — |
| KUPER | May 8, 2026 | ransomware_live | — |
| VeriCon | May 8, 2026 | ransomware_live | — |
| McCarthy | May 8, 2026 | ransomware_live | — |
| Arizona Professional Painting | May 8, 2026 | ransomware_live | — |
| CHX Express | May 8, 2026 | ransomware_live | — |
| DEVCO | May 8, 2026 | ransomware_live | — |
| Hillside Lumber | May 8, 2026 | ransomware_live | — |
| DermaPharm | May 8, 2026 | ransomware_live | — |
| Mundo Amtae | May 6, 2026 | ransomware_live | — |
| Worralls | May 6, 2026 | ransomware_live | — |
| Manhattan Fire Safety Corp | May 6, 2026 | ransomware_live | — |
| Clark Fixture Technologies | May 6, 2026 | ransomware_live | — |
| FMS | May 6, 2026 | ransomware_live | — |
| C2O Architects | May 6, 2026 | ransomware_live | — |
| DATAMATIC | May 6, 2026 | ransomware_live | — |
| Gator Cases | May 6, 2026 | ransomware_live | — |
| IPE | May 6, 2026 | ransomware_live | — |
| Riggotts | May 6, 2026 | ransomware_live | — |
| Da Guan Technology | May 6, 2026 | ransomware_live | — |
| Nrt India | May 6, 2026 | ransomware_live | — |
| Farmers Association of Iceland | May 3, 2026 | ransomware_live | — |
| La Kaffa International | May 3, 2026 | ransomware_live | — |
| Mediaplex | May 3, 2026 | ransomware_live | — |
| Marutake | May 3, 2026 | ransomware_live | — |
| Kasapreko | May 3, 2026 | ransomware_live | — |
| Levante Living | May 3, 2026 | ransomware_live | — |
| Ontario Physiotherapy Association | May 3, 2026 | ransomware_live | — |
| Millennium Partners | May 3, 2026 | ransomware_live | — |
| East | May 3, 2026 | ransomware_live | — |
| The Modern Flour Mill | May 3, 2026 | ransomware_live | — |
| Engineered Advantage | May 3, 2026 | ransomware_live | — |
| Triquim | May 3, 2026 | ransomware_live | — |
| Keretapi Tanah | May 3, 2026 | ransomware_live | — |
| Media Consulting | May 3, 2026 | ransomware_live | — |
| Arcelik | May 1, 2026 | ransomware_live | — |
| Diviso Grupo Financiero | April 29, 2026 | ransomware_live | — |
| Kınık Gross | April 29, 2026 | ransomware_live | — |
| Magisterial Service | April 29, 2026 | ransomware_live | — |
| Forsheda Stlverktyg | April 29, 2026 | ransomware_live | — |
| Fabritius | April 29, 2026 | ransomware_live | — |
| ACFA Regionale de Calgary | April 27, 2026 | ransomware_live | — |
| Beaconhouse School System | April 27, 2026 | ransomware_live | — |
| Colegio Notre Dame Campinas | April 27, 2026 | ransomware_live | — |
| IT Management | April 27, 2026 | ransomware_live | reported in press coverage |
| MIMS | April 27, 2026 | ransomware_live | — |
| Nostrum | April 27, 2026 | ransomware_live | — |
| Heinrich Kopp | April 27, 2026 | ransomware_live | — |
| Lawson Software | April 26, 2026 | ransomware_live | — |
| Coralina | April 26, 2026 | ransomware_live | — |
| EEC Group | April 26, 2026 | ransomware_live | — |
| Champion Homes | April 21, 2026 | ransomware_live | — |
| Uniview Technologies | April 20, 2026 | ransomware_live | — |
| Euro Creations | April 20, 2026 | ransomware_live | — |
| SmartSystems | April 20, 2026 | ransomware_live | — |
| The Marton Agency | April 19, 2026 | ransomware_live | — |
| Teleos Systems | April 19, 2026 | ransomware_live | — |
| Anderlues | April 19, 2026 | ransomware_live | — |
| Suma Sklep | April 19, 2026 | ransomware_live | — |
| Jean Cultural | April 19, 2026 | ransomware_live | — |
| Philip Lee | April 19, 2026 | ransomware_live | — |
| Jumbo Transport | April 19, 2026 | ransomware_live | — |
| Laboratório Santa Luzia | April 19, 2026 | ransomware_live | — |
| Bmtp | April 19, 2026 | ransomware_live | — |
| El Ordeno | April 15, 2026 | ransomware_live | — |
| Marchesi di Barolo | April 15, 2026 | ransomware_live | — |
| IC Partners | April 15, 2026 | ransomware_live | — |
| Disk Precision | April 15, 2026 | ransomware_live | — |
| Greenpharma | April 15, 2026 | ransomware_live | — |
| ******.*** | April 14, 2026 | ransomware_live | — |
| Caja De Seguro Social | April 14, 2026 | ransomware_live | — |
| Hangzhou Industrial | April 14, 2026 | ransomware_live | — |
| Verzinkerei Rentrop | April 14, 2026 | ransomware_live | — |
| NSOFT | April 14, 2026 | ransomware_live | — |
| BRC Biotechnology | April 14, 2026 | ransomware_live | — |
| Double C Farm | April 14, 2026 | ransomware_live | — |
| International Maritime Hospita | April 14, 2026 | ransomware_live | — |
| Harlem Stage | April 14, 2026 | ransomware_live | — |
| Cleor | April 14, 2026 | ransomware_live | — |
| Brand Collective | April 14, 2026 | ransomware_live | — |
| GEM Terminal | April 14, 2026 | ransomware_live | — |
| Intra | April 14, 2026 | ransomware_live | — |
| UK Electronics | April 14, 2026 | ransomware_live | — |
| PsychPlus | April 14, 2026 | ransomware_live | — |
| EMCO Holding | April 8, 2026 | ransomware_live | — |
| DGS | April 8, 2026 | ransomware_live | — |
| Win Academy | April 8, 2026 | ransomware_live | — |
| Mahyco Pvt | April 8, 2026 | ransomware_live | — |
| Ciarus | April 8, 2026 | ransomware_live | — |
| Hospital del Sur | April 8, 2026 | ransomware_live | — |
| Optima Servicios Financieros | April 8, 2026 | ransomware_live | — |
| ACE Consulting Engineers | April 8, 2026 | ransomware_live | — |
| Thai Special Gas | April 8, 2026 | ransomware_live | — |
| Structures Stucco | April 8, 2026 | ransomware_live | — |
| Thai Rung Union Car | April 8, 2026 | ransomware_live | — |
| Burning Rock Biotech | April 8, 2026 | ransomware_live | — |
| Metropolitan Pediatrics | April 8, 2026 | ransomware_live | — |
| Synergy France | April 8, 2026 | ransomware_live | — |
| DYSA | April 8, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).