thegentlemen
Known ransomware group ACTIVE Active · high-tempo
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
49
Total Claims
20
Critical
—
Records Claimed
14
Industries Hit
Active span: Apr 26, 2026 – Nov 2, 2026 · 49 organizations targeted
Active · high-tempo
Actor Threat Profile
Activity Timeline
Peak: Oct 2026 (16)Apr 2026
LessMore
Nov 2026Share this profile
Top Targeted Industries
Healthcare 14
Education 10
Financial Services 5
Government & Defense 3
Technology 3
Retail & E-Commerce 2
Tradecraft & Infrastructure
0
Documented tools
12 / 56
MITRE tactics / techniques
2
Known leak sites
Targeted Organizations
Secretaria de Estado de SaúdeLogsytech GroupMitsubishi Motors UkraineGroupe AC EnvironnementInedLydenburg ToyotaSAPWeld Re 8 School DistrictSBI Audiovisual MedinboxSaga UniversitySt Peters Anglican Primary SchoolMabrisAll Souls St Gabriels SchoolDeloitteSAS H2O MICHELUniversity of BuraimiHospital de la Santa Creu i Sant PauMandurah State Emergency ServiceWestrop Primary & Nursery SchoolEuroprimVUS - The English CenterANP HealthGuardriskAforpaPharmaEssentia CorporationAir CanadaMetroUniversity of San FranciscoCentral Arkansas PediatricsThe ClinicWCM RemediumInstitucion CervantesSuburban WaterDownriver Medical AssociatesEdgewood Surgical HospitalMichigan Surgical CenterBrian Jessel BMWSanatorio DeltaLe Perreux sur MarneYMCA of ColumbiaInternal MedicineInternet Technologies DesignsUniversity of Finance and AdministrationRoss Yerger InsuranceAmstel SecuritiesShajarpak SecuritiesValue Exchange InternationalDermaPharmEEC Group
Claims by thegentlemen
Low
Ransomware Claim: Secretaria de Estado de Saúde
Secretaria de Estado de Saúde
thegentlemen
Ransomware Government & Defense
Nov 6, 2026 Low
Ransomware Claim: Logsytech Group
Logsytech Group
thegentlemen
Ransomware Technology
Nov 5, 2026 Low
Ransomware Claim: Mitsubishi Motors Ukraine
Mitsubishi Motors Ukraine
thegentlemen
Ransomware Manufacturing
Nov 5, 2026 Low
Ransomware Claim: Groupe AC Environnement
Groupe AC Environnement
thegentlemen
Ransomware Energy & Utilities
Oct 31, 2026 Low
Ransomware Claim: Ined
Ined
thegentlemen
Ransomware Government & Defense
Oct 31, 2026 Low
Ransomware Claim: Lydenburg Toyota
Lydenburg Toyota
thegentlemen
Ransomware Retail & E-Commerce
Oct 31, 2026 Low
Ransomware Claim: SAP
SAP
thegentlemen
Ransomware Technology
Oct 31, 2026 Low
Ransomware Claim: Weld Re 8 School District
Weld Re 8 School District
thegentlemen
Ransomware Education
Oct 24, 2026 Critical
Ransomware Claim: SBI Audiovisual Medinbox
SBI Audiovisual Medinbox
thegentlemen
Ransomware Healthcare
Oct 16, 2026 Low
Ransomware Claim: Saga University
Saga University
thegentlemen
Ransomware Education
Oct 16, 2026 Low
Ransomware Claim: St Peters Anglican Primary School
St Peters Anglican Primary School
thegentlemen
Ransomware Education
Oct 16, 2026 Low
Ransomware Claim: Mabris
Mabris
thegentlemen
Ransomware
Oct 11, 2026 Low
Ransomware Claim: All Souls St Gabriels School
All Souls St Gabriels School
thegentlemen
Ransomware Education
Oct 10, 2026 Low
Ransomware Claim: Deloitte
Deloitte
thegentlemen
Ransomware Professional Services
Oct 10, 2026 Low
Ransomware Claim: SAS H2O MICHEL
SAS H2O MICHEL
thegentlemen
Ransomware Other
Oct 10, 2026 Low
Ransomware Claim: University of Buraimi
University of Buraimi
thegentlemen
Ransomware Education
Oct 10, 2026 Critical
Ransomware Claim: Hospital de la Santa Creu i Sant Pau
Hospital de la Santa Creu i Sant Pau
thegentlemen
Ransomware Healthcare
Oct 3, 2026 Low
Ransomware Claim: Mandurah State Emergency Service
Mandurah State Emergency Service
thegentlemen
Ransomware Government & Defense
Oct 3, 2026 Low
Ransomware Claim: Westrop Primary & Nursery School
Westrop Primary & Nursery School
thegentlemen
Ransomware Education
Oct 3, 2026 Critical
Ransomware Claim: Europrim
Europrim
thegentlemen
Ransomware Healthcare
Sep 30, 2026 Low
Ransomware Claim: VUS - The English Center
VUS - The English Center
thegentlemen
Ransomware Education
Sep 30, 2026 Critical
Ransomware Claim: ANP Health
ANP Health
thegentlemen
Ransomware Healthcare
Sep 26, 2026 Critical
Ransomware Claim: Guardrisk
Guardrisk
thegentlemen
Ransomware Financial Services
Sep 26, 2026 Low
Ransomware Claim: Aforpa
Aforpa
thegentlemen
Ransomware
Sep 15, 2026 Critical
Ransomware Claim: PharmaEssentia Corporation
PharmaEssentia Corporation
thegentlemen
Ransomware Healthcare
Sep 11, 2026 Low
Ransomware Claim: Air Canada
Air Canada
thegentlemen
Ransomware Transportation
Sep 11, 2026 Low
Ransomware Claim: Metro
Metro
thegentlemen
Ransomware Retail & E-Commerce
Sep 11, 2026 Low
Ransomware Claim: University of San Francisco
University of San Francisco
thegentlemen
Ransomware Education
Sep 11, 2026 Critical
Ransomware Claim: Central Arkansas Pediatrics
Central Arkansas Pediatrics
thegentlemen
Ransomware Healthcare
Jun 8, 2026 Critical
Ransomware Claim: The Clinic
The Clinic
thegentlemen
Ransomware Healthcare
Jun 8, 2026 Critical
Ransomware Claim: WCM Remedium
WCM Remedium
thegentlemen
Ransomware Healthcare
Jun 8, 2026 Low
Ransomware Claim: Institucion Cervantes
Institucion Cervantes
thegentlemen
Ransomware Education
Jun 8, 2026 Critical
Ransomware Claim: Suburban Water
Suburban Water
thegentlemen
Ransomware Energy
Jun 7, 2026 Critical
Ransomware Claim: Downriver Medical Associates
Downriver Medical Associates
thegentlemen
Ransomware Healthcare
Jun 4, 2026 Critical
500 GB leaked Ransomware Claim: Edgewood Surgical Hospital
Edgewood Surgical Hospital
thegentlemen
Ransomware Healthcare
Jun 4, 2026 Critical
Ransomware Claim: Michigan Surgical Center
Michigan Surgical Center
thegentlemen
Ransomware Healthcare
Jun 4, 2026 Low
Ransomware Claim: Brian Jessel BMW
Brian Jessel BMW
thegentlemen
Ransomware Consumer Services
Jun 4, 2026 Critical
Ransomware Claim: Sanatorio Delta
Sanatorio Delta
thegentlemen
Ransomware Healthcare
May 24, 2026 Low
Ransomware Claim: Le Perreux sur Marne
Le Perreux sur Marne
thegentlemen
Ransomware
May 24, 2026 Low
Ransomware Claim: YMCA of Columbia
YMCA of Columbia
thegentlemen
Ransomware Consumer Services
May 21, 2026 Critical
Ransomware Claim: Internal Medicine
Internal Medicine
thegentlemen
Ransomware Healthcare
May 19, 2026 Low
Ransomware Claim: Internet Technologies Designs
Internet Technologies Designs
thegentlemen
Ransomware Technology
May 19, 2026 Low
Ransomware Claim: University of Finance and Administration
University of Finance and Administration
thegentlemen
Ransomware Education
May 19, 2026 Critical
Ransomware Claim: Ross Yerger Insurance
Ross Yerger Insurance
thegentlemen
Ransomware Financial Services
May 17, 2026 Critical
Ransomware Claim: Amstel Securities
Amstel Securities
thegentlemen
Ransomware Financial Services
May 13, 2026 Critical
Ransomware Claim: Shajarpak Securities
Shajarpak Securities
thegentlemen
Ransomware Financial Services
May 13, 2026 Critical
Ransomware Claim: Value Exchange International
Value Exchange International
thegentlemen
Ransomware Financial Services
May 13, 2026 Critical
Ransomware Claim: DermaPharm
DermaPharm
thegentlemen
Ransomware Healthcare
May 10, 2026 High
Ransomware Claim: EEC Group
EEC Group
thegentlemen
Ransomware Business Services
Apr 27, 2026