thegentlemen
Also known as: Storm-2697First seen September 9, 2025Active1,002 claimed victims
The claims below are reproduced as posted by thegentlemen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Dos | February 24, 2026 | ransomware_live | — |
| El IBR | February 24, 2026 | ransomware_live | — |
| Industrias Iberia | February 24, 2026 | ransomware_live | — |
| Smartbytes | February 24, 2026 | ransomware_live | — |
| OKJ Group | February 24, 2026 | ransomware_live | — |
| MUST Informatique | February 24, 2026 | ransomware_live | — |
| Ruamjai | February 24, 2026 | ransomware_live | — |
| Sawafi | February 21, 2026 | ransomware_live | — |
| Perfumeria Pigmento | February 19, 2026 | ransomware_live | — |
| HUGS Insurance | February 19, 2026 | ransomware_live | — |
| Grupo Progresso | February 18, 2026 | ransomware_live | — |
| Qingtian Express Co. | February 18, 2026 | ransomware_live | — |
| Line Up Korea | February 17, 2026 | ransomware_live | — |
| Sasin Colleges & Universities | February 17, 2026 | ransomware_live | — |
| Pollo Cibao | February 17, 2026 | ransomware_live | — |
| True Value | February 16, 2026 | ransomware_live | — |
| Oceania Gas Chemicals & Related Products | February 15, 2026 | ransomware_live | — |
| Copamarina Beach Resort | February 15, 2026 | ransomware_live | — |
| Global Group | February 15, 2026 | ransomware_live | — |
| Intsika Yethu Municipality Government | February 15, 2026 | ransomware_live | — |
| BITS "Business Information Technology Solutions" | February 15, 2026 | ransomware_live | — |
| CROSS JEANS Zakrt | February 15, 2026 | ransomware_live | — |
| Comdat Datasystems | February 15, 2026 | ransomware_live | — |
| BITS Business Information Technology Solutions | February 15, 2026 | ransomware_live | — |
| Autostrad Rent a Car | February 13, 2026 | ransomware_live | — |
| Smart Glass | February 13, 2026 | ransomware_live | — |
| Nile Air Information | February 13, 2026 | ransomware_live | — |
| City of New Castle | February 13, 2026 | ransomware_live | — |
| Yash Highvoltage Insulators Pvt | February 13, 2026 | ransomware_live | — |
| Gruppo Avanti | February 13, 2026 | ransomware_live | — |
| Futue Bath | February 13, 2026 | ransomware_live | — |
| White Beach Hotel | February 13, 2026 | ransomware_live | — |
| Emirates National Group | February 12, 2026 | ransomware_live | — |
| Clark Foam Products | February 11, 2026 | ransomware_live | — |
| Thammasat University | February 11, 2026 | ransomware_live | — |
| Erg Otoyol | February 11, 2026 | ransomware_live | — |
| WCT Holdings Berhad | February 11, 2026 | ransomware_live | — |
| Area Limpia | February 10, 2026 | ransomware_live | — |
| Fgf Colleges & Universities | February 10, 2026 | ransomware_live | — |
| Agis Civil Engineering Construction | February 10, 2026 | ransomware_live | — |
| Museu do Caramulo | February 10, 2026 | ransomware_live | — |
| NFT Technology | February 10, 2026 | ransomware_live | — |
| UniFil | February 10, 2026 | ransomware_live | — |
| Instituto Nacional de Derechos Humanos | February 10, 2026 | ransomware_live | — |
| Smartply Europe | February 10, 2026 | ransomware_live | — |
| rea Limpia | February 8, 2026 | ransomware_live | — |
| KlearNow.AI | February 8, 2026 | ransomware_live | — |
| Far East | February 6, 2026 | ransomware_live | — |
| Ankara-İzmir | February 6, 2026 | ransomware_live | — |
| EXIM Bank | February 6, 2026 | ransomware_live | — |
| PLUS Malaysia Berhad | February 6, 2026 | ransomware_live | — |
| Torus | February 6, 2026 | ransomware_live | — |
| Chonburi Provincial Administration | February 6, 2026 | ransomware_live | — |
| Dome Partners | February 6, 2026 | ransomware_live | — |
| Gady Family | February 6, 2026 | ransomware_live | — |
| BAM - Brand Art Media | February 6, 2026 | ransomware_live | — |
| Nishiyama Seisakusho | February 6, 2026 | ransomware_live | — |
| Marina Home Interiors | February 6, 2026 | ransomware_live | — |
| Silvi SRL | February 6, 2026 | ransomware_live | — |
| Infinite Tiers Group | February 6, 2026 | ransomware_live | — |
| L'Aeroclub | February 6, 2026 | ransomware_live | — |
| Wells Fargo | February 6, 2026 | ransomware_live | — |
| Novetex Textiles | February 6, 2026 | ransomware_live | — |
| Hafa | February 6, 2026 | ransomware_live | — |
| CPQ Ingenieros | February 6, 2026 | ransomware_live | — |
| Ghana Bauxite Energy, Utilities & Waste | February 4, 2026 | ransomware_live | — |
| Wieson Technologies | January 31, 2026 | ransomware_live | — |
| Nobel Hygiene Pvt | January 31, 2026 | ransomware_live | — |
| Handsome Manufacturing | January 31, 2026 | ransomware_live | — |
| Trace | January 30, 2026 | ransomware_live | — |
| Kontena Nasional Berhad | January 20, 2026 | ransomware_live | — |
| San Carlo Gruppo Alimentare | January 20, 2026 | ransomware_live | — |
| [Redacted] #1930 | January 20, 2026 | ransomware_live | — |
| Ayuntamiento de Beniel | January 20, 2026 | ransomware_live | — |
| Shtainmetz Aminoach | January 20, 2026 | ransomware_live | — |
| Lotus Bedding | January 20, 2026 | ransomware_live | — |
| Rola Motor Group | January 20, 2026 | ransomware_live | — |
| Sita Sud | January 20, 2026 | ransomware_live | — |
| Witzenberg Municipality | January 20, 2026 | ransomware_live | — |
| WRP Asia Pacific Sdn Bhd | January 20, 2026 | ransomware_live | — |
| Magen Eco Energy | January 20, 2026 | ransomware_live | — |
| USTAR | January 20, 2026 | ransomware_live | — |
| Orlík Compressors | January 20, 2026 | ransomware_live | — |
| Autofinanciera | January 20, 2026 | ransomware_live | — |
| SASI JSC | January 20, 2026 | ransomware_live | — |
| Unimed Anápolis | January 20, 2026 | ransomware_live | — |
| Sincere Corporation | January 20, 2026 | ransomware_live | — |
| Casa de España | January 20, 2026 | ransomware_live | — |
| Garko | January 20, 2026 | ransomware_live | — |
| Sibca | January 20, 2026 | ransomware_live | — |
| Bluemega | January 20, 2026 | ransomware_live | — |
| PAO HWA TRADING LTD | January 19, 2026 | ransomware_live | — |
| Warka Bank for Investment and Finance | January 11, 2026 | ransomware_live | — |
| Dsm Information Technology Trade Ltd. | January 11, 2026 | ransomware_live | — |
| Real Tech | January 11, 2026 | ransomware_live | — |
| MBM | January 11, 2026 | ransomware_live | — |
| Systherm Grupa | January 7, 2026 | ransomware_live | — |
| Wamtechnik | January 7, 2026 | ransomware_live | — |
| Complexul Energetic Oltenia | January 6, 2026 | ransomware_live | — |
| Röben Tonbaustoffe GmbH | January 2, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).