the gentlemen
ransomware group · aka The Gentlemen · unknown · active since 2026-09-04 (first leak-site post tracked by this dashboard; earlier public reporting on the group: unknown)
Victims · 7d
30▲6 vs prev. week
Victims · 30d
153active targets
Victims · 90d
401
All-time (tracked)
919since 2025-09-09
Last post
09-14 20:03UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
The Gentlemen is a ransomware and data-extortion group that posts victim names on a public leak site and threatens to publish stolen data. In a burst of activity, this dashboard recorded 24 claimed victims between 2026-09-04 and 2026-09-09, spanning healthcare, aviation, retail, construction, manufacturing, and travel across North America, South America, Europe, and Asia. Recent press coverage links the group to attacks on electronic health records vendor Veradigm and hospital operator Nutex Health, in which patient data was reported stolen and threatened for release. Public reporting on the group's origins, affiliate model, and initial access techniques is limited, and no specific CVEs are widely attributed to it. Whether it is a newly emerged operation or a rebrand of an existing gang is unknown.
Tactics & tooling
- Runs a public leak site naming victims and threatening to publish stolen data
- Double extortion: data theft paired with leak threats; patient data cited in reported healthcare incidents
- Described in press coverage as a ransomware gang; encryption behavior not publicly documented
- High-velocity victim claiming: 24 posts within roughly one week (this dashboard, 2026)
- Broad multi-region, multi-sector targeting, including healthcare organizations holding patient/EHR data
- Initial access vector, tooling, and affiliate model: unknown
Targeted sectors
HealthcareHealthcare IT / electronic health recordsPharmaceuticals / biotechnologyAviationRetail / groceryConstructionManufacturingTravel / tourism
Notable public victims
Air Canada, Veradigm, Nutex Health, PharmaEssentia Corporation, Yapı Merkezi, Metro, Superstore, Ritz Safety, AbacoViaggi, Comin Sac
Estimated earnings
No public figure.
Leak-site victims919 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Afezo | · Mar 1, 2026 | — |
| Ricopia | · Mar 1, 2026 | — |
| All India Minerals | · Mar 1, 2026 | — |
| Labtician Ophthalmics | · Mar 1, 2026 | — |
| Special Shapes Refractory | · Mar 1, 2026 | — |
| Grand Hotel | · Feb 28, 2026 | — |
| Thg | · Feb 28, 2026 | — |
| Fundao Para | · Feb 28, 2026 | — |
| Universidade Federal de Sergipe | · Feb 26, 2026 | — |
| Sando Tech | · Feb 26, 2026 | — |
| ACFA | · Feb 26, 2026 | — |
| Amata | · Feb 26, 2026 | — |
| Zabun | · Feb 26, 2026 | — |
| Boutique Harley-Davidson | · Feb 26, 2026 | — |
| Silvestres | · Feb 26, 2026 | — |
| Nathalin Group | · Feb 26, 2026 | — |
| SATO | · Feb 26, 2026 | — |
| Advanced Connection Corporation | · Feb 26, 2026 | — |
| OCEANIST ENGINEERING | · Feb 26, 2026 | — |
| Ruamjai | · Feb 25, 2026 | — |
| MUST Informatique | · Feb 25, 2026 | — |
| OKJ Group | · Feb 25, 2026 | — |
| Smartbytes | · Feb 25, 2026 | — |
| Industrias Iberia | · Feb 25, 2026 | — |
| El IBR | · Feb 25, 2026 | — |
| Dos | · Feb 25, 2026 | — |
| Global Trust Advisors | · Feb 25, 2026 | — |
| Wachendorff | · Feb 25, 2026 | — |
| Silver Lake Medical Center | · Feb 24, 2026 | — |
| REDACTED | · Feb 20, 2026 | — |
| HUGS Insurance | · Feb 19, 2026 | — |
| Perfumeria Pigmento | · Feb 19, 2026 | — |
| Sawafi | · Feb 19, 2026 | — |
| Garuda Indonesia Airlines | · Feb 18, 2026 | — |
| Garuda Indonesia Airlines, Airports | · Feb 18, 2026 | — |
| Grupo Progresso | · Feb 18, 2026 | — |
| Qingtian Express Co. | · Feb 18, 2026 | — |
| Seac | · Feb 17, 2026 | — |
| Caribbean Medical Center | · Feb 17, 2026 | — |
| Pollo Cibao | · Feb 17, 2026 | — |
| Sejlstrup | · Feb 17, 2026 | — |
| Sasin Colleges & Universities | · Feb 17, 2026 | — |
| Line Up Korea | · Feb 17, 2026 | — |
| True Value | · Feb 16, 2026 | — |
| Oceania Gas Chemicals & Related Products | · Feb 15, 2026 | — |
| Comdat Datasystems | · Feb 15, 2026 | — |
| CROSS JEANS Zakrt | · Feb 15, 2026 | — |
| BITS "Business Information Technology Solutions" | · Feb 15, 2026 | — |
| Intsika Yethu Municipality Government | · Feb 15, 2026 | — |
| Global Group | · Feb 15, 2026 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .