the gentlemen
ransomware group · aka The Gentlemen · unknown · active since 2026-09-04 (first leak-site post tracked by this dashboard; earlier public reporting on the group: unknown)
Victims · 7d
30▲6 vs prev. week
Victims · 30d
153active targets
Victims · 90d
400
All-time (tracked)
919since 2025-09-09
Last post
09-14 20:03UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
The Gentlemen is a ransomware and data-extortion group that posts victim names on a public leak site and threatens to publish stolen data. In a burst of activity, this dashboard recorded 24 claimed victims between 2026-09-04 and 2026-09-09, spanning healthcare, aviation, retail, construction, manufacturing, and travel across North America, South America, Europe, and Asia. Recent press coverage links the group to attacks on electronic health records vendor Veradigm and hospital operator Nutex Health, in which patient data was reported stolen and threatened for release. Public reporting on the group's origins, affiliate model, and initial access techniques is limited, and no specific CVEs are widely attributed to it. Whether it is a newly emerged operation or a rebrand of an existing gang is unknown.
Tactics & tooling
- Runs a public leak site naming victims and threatening to publish stolen data
- Double extortion: data theft paired with leak threats; patient data cited in reported healthcare incidents
- Described in press coverage as a ransomware gang; encryption behavior not publicly documented
- High-velocity victim claiming: 24 posts within roughly one week (this dashboard, 2026)
- Broad multi-region, multi-sector targeting, including healthcare organizations holding patient/EHR data
- Initial access vector, tooling, and affiliate model: unknown
Targeted sectors
HealthcareHealthcare IT / electronic health recordsPharmaceuticals / biotechnologyAviationRetail / groceryConstructionManufacturingTravel / tourism
Notable public victims
Air Canada, Veradigm, Nutex Health, PharmaEssentia Corporation, Yapı Merkezi, Metro, Superstore, Ritz Safety, AbacoViaggi, Comin Sac
Estimated earnings
No public figure.
Leak-site victims919 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Flavor Producers | · Dec 19, 2025 | — |
| Solumek | · Dec 19, 2025 | — |
| *****.com | · Dec 12, 2025 | — |
| ***.*** LAST TIMER UPDATE | · Dec 10, 2025 | — |
| Everbiz Industrial Co. Ltd. | · Nov 29, 2025 | — |
| Devereux Advanced Behavioral Health | · Nov 28, 2025 | — |
| St Stephens International | · Nov 27, 2025 | — |
| United Enterprise Fund | · Nov 25, 2025 | — |
| AkroStar Technology Co., Ltd. Akrostar | · Nov 25, 2025 | — |
| ***.*** | · Nov 25, 2025 | — |
| Colliers | · Nov 25, 2025 | — |
| Sansala | · Nov 25, 2025 | — |
| Pacific Holdings Group JSC. | · Nov 25, 2025 | — |
| AiHealth | · Nov 25, 2025 | — |
| KIM Dental | · Nov 25, 2025 | — |
| NBCAPITAL JOINT STOCK COMPANY | · Nov 25, 2025 | — |
| Singapore City Development Company Limited (SINGCONS) | · Nov 25, 2025 | — |
| Talarico | · Nov 25, 2025 | — |
| Ecuacorriente S.A. | · Nov 25, 2025 | — |
| DRD Communications | · Nov 6, 2025 | — |
| St Stephen's International | · Nov 4, 2025 | — |
| Silverlake Axis | · Oct 30, 2025 | — |
| Donacoop (VinaCapital) | · Oct 26, 2025 | — |
| PT Pupuk Iskandar Muda | · Oct 22, 2025 | — |
| Madagascar Airlines | · Oct 18, 2025 | — |
| ICET Studios | · Oct 15, 2025 | — |
| Personal Collection | · Oct 9, 2025 | — |
| Seguros la Cmara | · Oct 8, 2025 | — |
| 2GO Group | · Oct 5, 2025 | — |
| AUSA Soluciones Logisticas | · Oct 4, 2025 | — |
| Astra Otoparts / PT. Inti Ganda Perdana | · Oct 3, 2025 | — |
| Al-Babtain Power & Telecommunication | · Sep 29, 2025 | — |
| Thai Future Inc. PCL | · Sep 27, 2025 | — |
| Cadisa | · Sep 23, 2025 | — |
| ARMONIA MEDICAL S.A.S. | · Sep 17, 2025 | — |
| Instituto Socio-Económico Comunitario (INSEC) | · Sep 17, 2025 | — |
| SV-Büro Ing. Schulz GmbH | · Sep 16, 2025 | — |
| Cervantes | · Sep 9, 2025 | — |
| Ceres | · Sep 9, 2025 | — |
| BIOLAP Soluciones Médicas | · Sep 9, 2025 | — |
| Proplastics | · Sep 9, 2025 | — |
| Kandeo | · Sep 9, 2025 | — |
| Ransomware Recover Indonesia | · Sep 9, 2025 | — |
| JN Aceros | · Sep 9, 2025 | — |
| Flexofast Indonesia | · Sep 9, 2025 | — |
| Del Campo Supreme | · Sep 9, 2025 | — |
| Cremona Inoxidable | · Sep 9, 2025 | — |
| Grupo Halcon | · Sep 9, 2025 | — |
| JIEI (Thailand) Co., Ltd | · Sep 9, 2025 | — |
| Wharton Independent | · Sep 9, 2025 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .