SBI Audiovisual Medinbox Ransomware Claim by thegentlemen (Oct 2026)

Claim Summary

On or around October 14, 2026, the ransomware group known as “thegentlemen” allegedly posted SBI Audiovisual Medinbox (sbiav.com) to its dark web leak site. The listing, which Yazoul Security has reviewed but not independently verified, claims the Quebec-based audiovisual production company as a victim. The group has not disclosed a data volume, sample files, or a ransom demand in the publicly visible portion of the claim.

SBI Audiovisual Medinbox is described in the listing as a Saint-Bruno-de-Montarville company founded in 1991, with roughly 11 staff. The company reportedly specializes in corporate event production, including sound, lighting, video, and webcasting, alongside a niche in live streaming of surgical operations for medical training. According to the threat actor, the firm deploys a mobile system called CASTER and holds exclusive North American rights to France’s Medinbox technology, which has purportedly been used at hospitals such as Mount Sinai in New York.

None of these operational details have been confirmed by SBI Audiovisual Medinbox, and the company has not issued a public statement as of this writing.

Threat Actor Profile

The claim is attributed to thegentlemen, a ransomware operation with limited publicly available research. At the time of writing, Yazoul Security has no confirmed data on the group’s total victim count, preferred initial access vectors, or tooling. No public YARA rules, detection signatures, or technical references specific to this group are available in our current intelligence holdings.

Because the group’s track record is essentially undocumented in open sources, its credibility cannot be meaningfully assessed. This is a significant caveat: some ransomware brands are established and methodical, while others are rebrands, short-lived operations, or actors that post claims without follow-through. The absence of any prior research means analysts should treat the claim with heightened skepticism rather than assuming either legitimacy or fabrication.

Alleged Data Exposure

The leak site entry does not specify a data volume. The threat actor’s description focuses on the victim’s business profile rather than the contents of any exfiltrated files. No samples, screenshots, file trees, or categories of data (for example, patient records, contracts, or financial documents) have been publicly displayed in the portion of the listing reviewed.

This matters for two reasons. First, a claim without evidence is harder to validate and may indicate a pressure tactic rather than a completed exfiltration. Second, the victim operates in a space adjacent to healthcare, specifically live surgical broadcasting for medical training. If any patient-adjacent data were involved, the regulatory and privacy implications would be substantial. However, at this stage, that is speculation, not a confirmed fact.

Potential Impact

If the claim is accurate, potential consequences could include business disruption to event production and surgical broadcast services, reputational harm with hospital and corporate clients, and possible notification obligations under Canadian and Quebec privacy law if personal or health information were affected. The company’s role as an integrator, rather than a manufacturer of the Medinbox technology, may limit some downstream exposure, but client trust in live-surgery workflows is sensitive to any security incident.

Ransomware groups routinely exaggerate or misrepresent claims to pressure victims into paying. The lack of disclosed data volume or samples should temper any assumption that a significant breach occurred.

What to Watch For

• Any official statement from SBI Audiovisual Medinbox confirming or denying the incident.
• Publication of data samples or a revised leak site entry with specifics.
• Notification from Quebec’s privacy regulator or affected hospital partners.
• Reuse of the “thegentlemen” brand across additional victims, which would help establish the group’s patterns.
• Independent forensic reporting that corroborates or refutes the claim.

Disclaimer

This report is based solely on an unverified claim posted to a ransomware group’s leak site. Yazoul Security has not independently confirmed the attack, the exfiltration of any data, or the accuracy of the threat actor’s description of the victim. Nothing in this article should be treated as established fact. Organizations should rely on their own incident response and legal counsel before drawing conclusions.