thegentlemen
Also known as: Storm-2697First seen September 9, 2025Active816 claimed victims
The claims below are reproduced as posted by thegentlemen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| DTI Foreign Trade Service Corps | February 19, 2025 | ransomware_live | — |
| Hog Slat | February 19, 2025 | ransomware_live | — |
| Dekoyap | February 19, 2025 | ransomware_live | — |
| Pos Bilişim Teknolojileri | February 19, 2025 | ransomware_live | — |
| Rogers Capital | February 19, 2025 | ransomware_live | — |
| British School of Brasilia | February 19, 2025 | ransomware_live | — |
| BIB Insurance Brokers | February 19, 2025 | ransomware_live | — |
| Paltrack | February 19, 2025 | ransomware_live | — |
| CPF Financial Services | February 19, 2025 | ransomware_live | — |
| Abatix | February 19, 2025 | ransomware_live | — |
| Lawsoft | February 19, 2025 | ransomware_live | — |
| Seac | February 19, 2025 | ransomware_live | — |
| Universidade Federal de Sergipe | February 19, 2025 | ransomware_live | — |
| PT Pupuk Iskandar Muda | April 3, 2024 | ransomware_live | — |
| Garuda Indonesia Airlines | July 9, 2023 | ransomware_live | — |
| LSA International | February 28, 2023 | ransomware_live | — |
← NewerPage 9 of 9
Claim data from ransomware.live and RansomLook (CC BY 4.0).