thegentlemen
Also known as: Storm-2697First seen September 9, 2025Active1,002 claimed victims
The claims below are reproduced as posted by thegentlemen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Gesvalt | April 8, 2026 | ransomware_live | — |
| Ravands Plastech | April 8, 2026 | ransomware_live | — |
| Test Rite | April 8, 2026 | ransomware_live | — |
| Tapon Corona | April 8, 2026 | ransomware_live | — |
| Aichi Electric | April 8, 2026 | ransomware_live | — |
| Heatherwood Golf Club | April 6, 2026 | ransomware_live | — |
| Innovision Holdings | April 5, 2026 | ransomware_live | — |
| **********.com | April 4, 2026 | ransomware_live | — |
| jrk.com | April 4, 2026 | ransomware_live | — |
| Equity Life | April 4, 2026 | ransomware_live | — |
| Zamek Namest | April 4, 2026 | ransomware_live | — |
| Dreamtoy | April 4, 2026 | ransomware_live | — |
| UCPS | April 4, 2026 | ransomware_live | — |
| Terminal 21 | April 4, 2026 | ransomware_live | — |
| Medici Group | April 4, 2026 | ransomware_live | — |
| Far East Fame | April 4, 2026 | ransomware_live | — |
| alloha.com | April 4, 2026 | ransomware_live | — |
| Gaposa | April 4, 2026 | ransomware_live | — |
| St Fabian | April 4, 2026 | ransomware_live | — |
| GCA Group | April 4, 2026 | ransomware_live | — |
| GCA Professional | April 4, 2026 | ransomware_live | — |
| Das Labor | April 4, 2026 | ransomware_live | — |
| Zanzi | April 4, 2026 | ransomware_live | — |
| AIRCOS | April 4, 2026 | ransomware_live | — |
| Jati Tinggi | March 26, 2026 | ransomware_live | — |
| Casa Andina | March 26, 2026 | ransomware_live | — |
| CH Express | March 26, 2026 | ransomware_live | — |
| Americo Advogados | March 26, 2026 | ransomware_live | — |
| Sunspray Food | March 26, 2026 | ransomware_live | — |
| Cosmo Group | March 26, 2026 | ransomware_live | — |
| SYSTHERM INFO | March 26, 2026 | ransomware_live | — |
| Sgt | March 26, 2026 | ransomware_live | — |
| Friktimporten Stockholm | March 26, 2026 | ransomware_live | — |
| Distritech | March 23, 2026 | ransomware_live | — |
| Omikenshi | March 23, 2026 | ransomware_live | — |
| Grupo Tawa | March 23, 2026 | ransomware_live | — |
| Delta Ducon Engenharia | March 23, 2026 | ransomware_live | — |
| Adaptavist Group LTD | March 23, 2026 | ransomware_live | — |
| SATS Sports Club Sweden | March 22, 2026 | ransomware_live | — |
| PTT Philippines | March 22, 2026 | ransomware_live | — |
| Groupe Caddac | March 21, 2026 | ransomware_live | — |
| Micro Leasing | March 21, 2026 | ransomware_live | — |
| Rajagiri Hospital | March 21, 2026 | ransomware_live | — |
| MEDICUS SHUPPAN | March 21, 2026 | ransomware_live | — |
| Cerio | March 19, 2026 | ransomware_live | — |
| MicroChem | March 19, 2026 | ransomware_live | — |
| Economia | March 18, 2026 | ransomware_live | — |
| Excellentiam | March 18, 2026 | ransomware_live | — |
| 2LG Prod | March 18, 2026 | ransomware_live | — |
| GPAINNOVA | March 18, 2026 | ransomware_live | — |
| Vexin Normand | March 18, 2026 | ransomware_live | — |
| BCN Medical | March 16, 2026 | ransomware_live | — |
| Chase Asia | March 16, 2026 | ransomware_live | — |
| Canal Capital | March 16, 2026 | ransomware_live | — |
| Payap University | March 16, 2026 | ransomware_live | — |
| Kabelovna Kabex | March 16, 2026 | ransomware_live | — |
| Cortporation Colina | March 16, 2026 | ransomware_live | — |
| Centro de Especialidades | March 16, 2026 | ransomware_live | — |
| Caribbean Medical Center | March 16, 2026 | ransomware_live | — |
| ControlGMC | March 12, 2026 | ransomware_live | — |
| St Fabian Catholic | March 12, 2026 | ransomware_live | — |
| Einstein Technology | March 12, 2026 | ransomware_live | — |
| Docaret | March 11, 2026 | ransomware_live | — |
| Grupo San Jacinto | March 9, 2026 | ransomware_live | — |
| Cosmesia | March 9, 2026 | ransomware_live | — |
| Sodimatel Fasteners | March 9, 2026 | ransomware_live | — |
| Kpropha | March 9, 2026 | ransomware_live | — |
| Nenplas | March 9, 2026 | ransomware_live | — |
| eDevice | March 9, 2026 | ransomware_live | — |
| Gerleinco | March 6, 2026 | ransomware_live | — |
| LAF Hotel Aree | March 6, 2026 | ransomware_live | — |
| Malia Group | March 6, 2026 | ransomware_live | — |
| Nephrology Associates | March 6, 2026 | ransomware_live | — |
| Reanthong Partcenter | March 4, 2026 | ransomware_live | — |
| Comtec 2000 | March 4, 2026 | ransomware_live | — |
| Primus | March 4, 2026 | ransomware_live | — |
| CHS Villach | March 3, 2026 | ransomware_live | — |
| Special Shapes Refractory | March 1, 2026 | ransomware_live | — |
| Labtician Ophthalmics | March 1, 2026 | ransomware_live | — |
| All India Minerals | March 1, 2026 | ransomware_live | — |
| Ricopia | March 1, 2026 | ransomware_live | — |
| Afezo | March 1, 2026 | ransomware_live | — |
| Fundao Para | February 27, 2026 | ransomware_live | — |
| Thg | February 27, 2026 | ransomware_live | — |
| Sejlstrup | February 27, 2026 | ransomware_live | — |
| Grand Hotel | February 27, 2026 | ransomware_live | — |
| Amata | February 26, 2026 | ransomware_live | — |
| ACFA | February 26, 2026 | ransomware_live | — |
| Sando Tech | February 26, 2026 | ransomware_live | — |
| Zabun | February 26, 2026 | ransomware_live | — |
| Nathalin Group | February 25, 2026 | ransomware_live | — |
| Silvestres | February 25, 2026 | ransomware_live | — |
| Boutique Harley-Davidson | February 25, 2026 | ransomware_live | — |
| OCEANIST ENGINEERING | February 25, 2026 | ransomware_live | — |
| Advanced Connection Corporation | February 25, 2026 | ransomware_live | — |
| REDACTED | February 25, 2026 | ransomware_live | — |
| SATO | February 25, 2026 | ransomware_live | — |
| Silver Lake Medical Center | February 24, 2026 | ransomware_live | — |
| Wachendorff | February 24, 2026 | ransomware_live | — |
| Global Trust Advisors | February 24, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).