the gentlemen
ransomware group · aka The Gentlemen · unknown · active since 2026-09-04 (first leak-site post tracked by this dashboard; earlier public reporting on the group: unknown)
Victims · 7d
30▲6 vs prev. week
Victims · 30d
153active targets
Victims · 90d
400
All-time (tracked)
919since 2025-09-09
Last post
09-14 20:03UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
The Gentlemen is a ransomware and data-extortion group that posts victim names on a public leak site and threatens to publish stolen data. In a burst of activity, this dashboard recorded 24 claimed victims between 2026-09-04 and 2026-09-09, spanning healthcare, aviation, retail, construction, manufacturing, and travel across North America, South America, Europe, and Asia. Recent press coverage links the group to attacks on electronic health records vendor Veradigm and hospital operator Nutex Health, in which patient data was reported stolen and threatened for release. Public reporting on the group's origins, affiliate model, and initial access techniques is limited, and no specific CVEs are widely attributed to it. Whether it is a newly emerged operation or a rebrand of an existing gang is unknown.
Tactics & tooling
- Runs a public leak site naming victims and threatening to publish stolen data
- Double extortion: data theft paired with leak threats; patient data cited in reported healthcare incidents
- Described in press coverage as a ransomware gang; encryption behavior not publicly documented
- High-velocity victim claiming: 24 posts within roughly one week (this dashboard, 2026)
- Broad multi-region, multi-sector targeting, including healthcare organizations holding patient/EHR data
- Initial access vector, tooling, and affiliate model: unknown
Targeted sectors
HealthcareHealthcare IT / electronic health recordsPharmaceuticals / biotechnologyAviationRetail / groceryConstructionManufacturingTravel / tourism
Notable public victims
Air Canada, Veradigm, Nutex Health, PharmaEssentia Corporation, Yapı Merkezi, Metro, Superstore, Ritz Safety, AbacoViaggi, Comin Sac
Estimated earnings
No public figure.
Leak-site victims919 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Röben Tonbaustoffe GmbH | · Jan 31, 2026 | — |
| MBM | · Jan 24, 2026 | — |
| Bluemega | · Jan 21, 2026 | — |
| Sibca | · Jan 21, 2026 | — |
| Garko | · Jan 21, 2026 | — |
| Casa de España | · Jan 21, 2026 | — |
| Sincere Corporation | · Jan 21, 2026 | — |
| Unimed Anápolis | · Jan 21, 2026 | — |
| Ayuntamiento de Beniel | · Jan 20, 2026 | — |
| SASI JSC | · Jan 20, 2026 | — |
| Autofinanciera | · Jan 20, 2026 | — |
| CPF Financial Services | · Jan 20, 2026 | — |
| Orlík Compressors | · Jan 20, 2026 | — |
| USTAR | · Jan 20, 2026 | — |
| Magen Eco Energy | · Jan 20, 2026 | — |
| WRP Asia Pacific Sdn Bhd | · Jan 20, 2026 | — |
| Witzenberg Municipality | · Jan 20, 2026 | — |
| Sita Sud | · Jan 20, 2026 | — |
| Rola Motor Group | · Jan 20, 2026 | — |
| Paltrack | · Jan 20, 2026 | — |
| Lotus Bedding | · Jan 20, 2026 | — |
| Shtainmetz Aminoach | · Jan 20, 2026 | — |
| BIB Insurance Brokers | · Jan 20, 2026 | — |
| British School of Brasilia | · Jan 20, 2026 | — |
| Eurotex | · Jan 20, 2026 | — |
| San Carlo Gruppo Alimentare | · Jan 20, 2026 | — |
| Kontena Nasional Berhad | · Jan 20, 2026 | — |
| PAO HWA TRADING LTD | · Jan 19, 2026 | — |
| Dongguan HYX Industrial | · Jan 16, 2026 | — |
| Rogers Capital | · Jan 14, 2026 | — |
| Dekoyap | · Jan 12, 2026 | — |
| Warka Bank for Investment and Finance | · Jan 12, 2026 | — |
| Hog Slat | · Jan 12, 2026 | — |
| DTI Foreign Trade Service Corps | · Jan 12, 2026 | — |
| Real Tech | · Jan 12, 2026 | — |
| Dsm Information Technology Trade Ltd. | · Jan 12, 2026 | — |
| Pos Bilişim Teknolojileri | · Jan 12, 2026 | — |
| Wamtechnik | · Jan 7, 2026 | — |
| Systherm Grupa | · Jan 7, 2026 | — |
| Hart | · Jan 7, 2026 | — |
| Complexul Energetic Oltenia | · Jan 6, 2026 | — |
| Stewart Engenharia | · Dec 30, 2025 | — |
| BioNet-Asia | · Dec 30, 2025 | — |
| Usina Sao Jose Do Pinheiro | · Dec 24, 2025 | — |
| Ever Green Industria e Comercio Ltda | · Dec 24, 2025 | — |
| All Rush | · Dec 24, 2025 | — |
| Santa Casa de Assis | · Dec 24, 2025 | — |
| Solus Tecnologia em Sistemas LTDA | · Dec 24, 2025 | — |
| HSR Specialist Researchers | · Dec 24, 2025 | — |
| ********.com | · Dec 19, 2025 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .