the gentlemen
ransomware group · aka The Gentlemen · unknown · active since 2026-09-04 (first leak-site post tracked by this dashboard; earlier public reporting on the group: unknown)
Victims · 7d
30▲6 vs prev. week
Victims · 30d
153active targets
Victims · 90d
400
All-time (tracked)
919since 2025-09-09
Last post
09-14 20:03UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
The Gentlemen is a ransomware and data-extortion group that posts victim names on a public leak site and threatens to publish stolen data. In a burst of activity, this dashboard recorded 24 claimed victims between 2026-09-04 and 2026-09-09, spanning healthcare, aviation, retail, construction, manufacturing, and travel across North America, South America, Europe, and Asia. Recent press coverage links the group to attacks on electronic health records vendor Veradigm and hospital operator Nutex Health, in which patient data was reported stolen and threatened for release. Public reporting on the group's origins, affiliate model, and initial access techniques is limited, and no specific CVEs are widely attributed to it. Whether it is a newly emerged operation or a rebrand of an existing gang is unknown.
Tactics & tooling
- Runs a public leak site naming victims and threatening to publish stolen data
- Double extortion: data theft paired with leak threats; patient data cited in reported healthcare incidents
- Described in press coverage as a ransomware gang; encryption behavior not publicly documented
- High-velocity victim claiming: 24 posts within roughly one week (this dashboard, 2026)
- Broad multi-region, multi-sector targeting, including healthcare organizations holding patient/EHR data
- Initial access vector, tooling, and affiliate model: unknown
Targeted sectors
HealthcareHealthcare IT / electronic health recordsPharmaceuticals / biotechnologyAviationRetail / groceryConstructionManufacturingTravel / tourism
Notable public victims
Air Canada, Veradigm, Nutex Health, PharmaEssentia Corporation, Yapı Merkezi, Metro, Superstore, Ritz Safety, AbacoViaggi, Comin Sac
Estimated earnings
No public figure.
Leak-site victims919 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Kuwait Portland Cement | · Sep 9, 2025 | — |
| Amv International Development | · Sep 9, 2025 | — |
| Liceo Francés Antoine y Consuelo de Saint-Exupéry | · Sep 9, 2025 | — |
| Dolidol | · Sep 9, 2025 | — |
| AB Mauri Private | · Sep 9, 2025 | — |
| InjectSense | · Sep 9, 2025 | — |
| Algorithmica Research | · Sep 9, 2025 | — |
| Sigma | · Sep 9, 2025 | — |
| PC Chandra Jewellers | · Sep 9, 2025 | — |
| Shifa Oman | · Sep 9, 2025 | — |
| Oriental de Seguros | · Sep 9, 2025 | — |
| Venezuela Re | · Sep 9, 2025 | — |
| J.V.D.B. & Associates Inc | · Sep 9, 2025 | — |
| Laboratorio Clinico Santa Rita | · Sep 9, 2025 | — |
| Narumi (Thailand) Co.,Ltd. | · Sep 9, 2025 | — |
| Ophtazon | · Sep 9, 2025 | — |
| Surtel Technologies Pvt | · Sep 9, 2025 | — |
| Saelen/Heizomat | · Sep 9, 2025 | — |
| LOCATION PEINTURES PRESTATIONS (LPP) | · Sep 9, 2025 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .