The Gentlemen 2026 activity
Ransomware group. 47 reports in 17 countries: 5 confirmed, 42 claimed or disputed. Latest 31 Oct 2026.
Indonesia · 
Vietnam · 
Thailand · 
Ireland · 
Singapore · 
South Africa · 
Malaysia · 
Saudi Arabia · 
Canada · 
Netherlands · 
Colombia · 
Bangladesh · 
Argentina · 
Pakistan · 
Egypt · 
Kenya · 
Philippines
🎯 What sources say
- Malaysia: Listed PLUS, WCT, Kontena Nasional, KTMB, UiTM Holdings, SGS Malaysia, the Malaysian Nuclear Agency and EP Manufacturing between February and August 2026. ransomware.live Malaysia
- Singapore: Listed MIMS, Times Software, NTU Alumni Club and Charles & Keith in 2026. ransomware.live ransomware.live
- Indonesia: Listed Garuda Indonesia, Equity Life, Pertamina, Solaria and WIKA Beton on its leak site between February and October 2026. ransomware.live ransomware.live
- Thailand: Most active group on Thai victims in 2026 by leak-site count, listing universities, a provincial administration, Terminal 21, Amata and Museum Siam. ransomware.live Thailand
- Philippines: Listed DTI Foreign Trade Service Corps, PTT Philippines, White Beach Hotel and PSBank between January and August. Ransomware.live (Philippines)
- Vietnam: Listed SASI JSC in January and a Vietnamese firm in June 2026, besides the tracked FPT Software and VUS claims. ransomware.live Vietnam map
- Netherlands: Thialf was the group's eighth Dutch victim, according to RTL Nieuws. NL Times
- Mexico: Posted many Mexican manufacturing, retail and hospitality victims through 2026. ransomware.live
- Brazil: The most frequent group on leak-site posts naming Brazilian victims in 2026. ransomware.live
- Argentina: Claimed Mercado Libre and Transportadora de Gas del Norte in 2026. ransomware.live
- Chile: Claimed Chilean victims including the national human rights institute (INDH) in 2026. ransomware.live
- Colombia: Claimed the Ecopetrol attack in July 2026. ransomware.live
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
 ⚠️ ClaimedWIKA Beton (PT Wijaya Karya Beton Tbk, BUMN group) | Indonesia | 31 Oct 2026 | Manufacturing | Ransomware | The Gentlemen | Claimed. The Gentlemen listed the state-group precast concrete maker with an estimated attack date of 26 October; no data volume was stated. | ransomware.live · Dark Web Intelligence on X✓ 7 Nov |
 ⚠️ ClaimedFPT Software | Vietnam | 31 Oct 2026 | Other | Ransomware | The Gentlemen | Claimed. Listed on The Gentlemen's leak site; FPT has not commented. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedWellington College International School Bangkok | Thailand | 17 Oct 2026 | Education | Ransomware | The Gentlemen | Claimed. The Gentlemen listed Wellington College International School Bangkok on its leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedThai Ha PCL | Thailand | 16 Oct 2026 | Manufacturing | Ransomware | The Gentlemen | Claimed. The SET-listed food maker is listed on The Gentlemen's leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedMuseum Siam | Thailand | 16 Oct 2026 | Other | Ransomware | The Gentlemen | Claimed. The Gentlemen listed Museum Siam on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedEngineers Ireland | Ireland | 16 Oct 2026 | Other | Ransomware | The Gentlemen | Claimed. TheGentlemen listed the national engineering body on its leak site and threatened a full leak. No statement from Engineers Ireland found. | DeXpose✓ 8 Nov |
 ⚠️ ClaimedRoyal Thai Air Force | Thailand | 10 Oct 2026 | Government | Ransomware | The Gentlemen | Claimed. Listed on The Gentlemen's leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedSolaria restaurant chain | Indonesia | 30 Sep 2026 | Retail | Ransomware | The Gentlemen | Claimed. The Gentlemen listed the Solaria restaurant chain with an estimated attack date of 29 September. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedVUS English Center | Vietnam | 30 Sep 2026 | Education | Ransomware | The Gentlemen | Claimed. Listed on The Gentlemen's leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedCharles & Keith | Singapore | 26 Sep 2026 | Retail | Ransomware | The Gentlemen | Claimed. Listed on The Gentlemen's leak site. | ransomware.live✓ 7 Nov |
 ✅ ConfirmedHollardVia a vendorFull story | South Africa | 7 Sep 2026 | Finance | Data leak | The Gentlemen | Confirmed. MIP linked the Hollard material to its June breach. Hollard refused to pay and says its own systems were not compromised. Claimed. The Gentlemen listed Hollard and published funeral policyholders' details. | TechCentral · ransomware.live✓ 8 Nov |
 ⚠️ ClaimedEP Manufacturing (EPMB) | Malaysia | 31 Aug 2026 | Manufacturing | Ransomware | The Gentlemen | Claimed. The Gentlemen listed EP Manufacturing Bhd on its leak site. | ransomware.live (Malaysia map)✓ 7 Nov |
 ⚠️ ClaimedSaudi Consulting Services (Saud Consult) | Saudi Arabia | 31 Aug 2026 | Other | Ransomware | The Gentlemen | Claimed. The Gentlemen listed the engineering consultancy on its leak site. | ransomware.live✓ 8 Nov |
 ✅ ConfirmedSaskatoon Tribal Council | Canada | 21 Aug 2026 | Government | Intrusion | The Gentlemen | Confirmed. The council said an incident found on 21 August may have exposed health, child and family service, HR and financial records. Claimed. The Gentlemen ransomware group listed the council as a victim. | Saskatoon Tribal Council · BlackFog, State of Ransomware October 2026✓ 7 Nov |
 ⚠️ ClaimedNTU Alumni Club | Singapore | 10 Aug 2026 | Education | Ransomware | The Gentlemen | Claimed. The The Gentlemen group listed NTU Alumni Club on its leak site on 2026-08-10. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedPertamina | Indonesia | 31 Jul 2026 | Energy | Ransomware | The Gentlemen | Claimed. The Gentlemen claimed more than 1.2 TB of Pertamina data including HR records, technical drawings, SCADA documents and bank statements; this listing is separate from the later RansomHouse claim. | ransomware.live · cybersecurity.or.id✓ 7 Nov |
 ⚠️ ClaimedMalaysian Nuclear Agency (Nuklear Malaysia)Selangor | Malaysia | 30 Jul 2026 | Government | Ransomware | The Gentlemen | Claimed. The Gentlemen listed the Malaysian Nuclear Agency with an estimated attack date of 29 July. | ransomware.live✓ 7 Nov |
 ✅ ConfirmedThialf ice stadium | Netherlands | 24 Jul 2026 | Other | Ransomware | The Gentlemen | Confirmed. Thialf confirmed to RTL Nieuws that it was hit by a cyberattack and was in talks with the criminals. Claimed. RTL Nieuws attributed the attack to The Gentlemen, which claims internal documents and staff data. | NL Times✓ 7 Nov |
 ✅ ConfirmedEcopetrol | Colombia | 19 Jul 2026 | Energy | Data leak | The Gentlemen | Confirmed. Ecopetrol said unauthorized access to its cloud file storage exposed data tied to about 3,300 user accounts and production was not disrupted. Claimed. The Gentlemen claimed the attack and up to 1 TB of data. | TechRadar · BlackFog, State of Ransomware July 2026 · ransomware.live✓ 7 Nov |
 ⚠️ ClaimedBRAC | Bangladesh | 16 Jul 2026 | Other | Ransomware | The Gentlemen | Claimed. The Gentlemen listed BRAC on its leak site and threatened to publish data. BRAC has not commented. | ransomware.live✓ 8 Nov |
 ⚠️ ClaimedMercado Libre | Argentina | 8 Jul 2026 | Retail | Ransomware | The Gentlemen | Claimed. The Gentlemen listed Mercado Libre on its leak site; the company reported no disruption and did not confirm a breach. | Escudo Digital · ransomware.live✓ 7 Nov |
 ⚠️ ClaimedRoyal Thai Navy Housing Cooperative | Thailand | 1 Jul 2026 | Finance | Ransomware | The Gentlemen | Claimed. The Gentlemen listed the Royal Thai Navy Housing Cooperative on its leak site. | ransomware.live✓ 7 Nov |
 ✅ ConfirmedMIP HoldingsFull story | South Africa | 26 Jun 2026 | Other | Data leak | The Gentlemen | Confirmed. Insurance software supplier MIP confirmed attackers used reused staff credentials to reach a support platform and took about 400,000 records tied to some 45 insurers. MIP paid a ransom, and data was published anyway. | TechCentral✓ 8 Nov |
 ⚠️ ClaimedSGS Malaysia | Malaysia | 20 Jun 2026 | Other | Ransomware | The Gentlemen | Claimed. The Gentlemen listed SGS Malaysia with an estimated attack date of 18 June. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedTimes Software | Singapore | 15 Jun 2026 | Other | Ransomware | The Gentlemen | Claimed. The The Gentlemen group listed Times Software on its leak site on 2026-06-15. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedUiTM HoldingsSelangor | Malaysia | 11 Jun 2026 | Education | Ransomware | The Gentlemen | Claimed. The Gentlemen listed UiTM Holdings, the investment arm of UiTM, with an estimated attack date of 10 June. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedThoresen Thai Agencies | Thailand | 4 Jun 2026 | Transport | Ransomware | The Gentlemen | Claimed. The Gentlemen listed Thoresen Thai Agencies on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedKeretapi Tanah Melayu (KTMB)Kuala Lumpur | Malaysia | 6 May 2026 | Transport | Ransomware | The Gentlemen | Claimed. The Gentlemen listed KTMB (ktmb.com.my) with an estimated attack date of 3 May. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedMIMS | Singapore | 6 May 2026 | Health | Ransomware | The Gentlemen | Claimed. The The Gentlemen group listed MIMS on its leak site on 2026-05-06. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedBeaconhouse School System | Pakistan | 6 May 2026 | Education | Ransomware | The Gentlemen | Claimed. The Gentlemen listed the school group and said the full leak would follow unless it made contact. | DeXpose · ransomware.live✓ 8 Nov |
| ⚠️ ClaimedPhilip Lee | Ireland | 19 Apr 2026 | Other | Ransomware | The Gentlemen | Claimed. TheGentlemen listed the Dublin corporate law firm on its leak site. No firm statement found. | ransomware.live✓ 8 Nov |
 ⚠️ ClaimedEquity Life Indonesia | Indonesia | 4 Apr 2026 | Finance | Ransomware | The Gentlemen | Claimed. The Gentlemen listed the life insurer on its leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedTerminal 21 | Thailand | 4 Apr 2026 | Retail | Ransomware | The Gentlemen | Claimed. The Gentlemen listed Terminal 21 on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedPayap University | Thailand | 16 Mar 2026 | Education | Ransomware | The Gentlemen | Claimed. The Gentlemen listed Payap University on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedAmata Corporation PCL | Thailand | 26 Feb 2026 | Property | Ransomware | The Gentlemen | Claimed. The Gentlemen listed Amata on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedRuamjairak Hospital | Thailand | 24 Feb 2026 | Health | Ransomware | The Gentlemen | Claimed. The Gentlemen listed Ruamjai (ruamjaimedical.co.th) on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedGaruda Indonesia | Indonesia | 21 Feb 2026 | Transport | Ransomware | The Gentlemen | Claimed. The Gentlemen listed the state airline on its leak site; the tracker estimates the attack date as July 2023. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedNile Air | Egypt | 13 Feb 2026 | Transport | Ransomware | The Gentlemen | Claimed. The Gentlemen listed the Egyptian airline on its leak site and threatened to release data. | DeXpose · ransomware.live✓ 8 Nov |
 ⚠️ ClaimedWCT Holdings | Malaysia | 11 Feb 2026 | Property | Ransomware | The Gentlemen | Claimed. The Gentlemen listed WCT Holdings Berhad on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedThammasat University | Thailand | 11 Feb 2026 | Education | Ransomware | The Gentlemen | Claimed. The Gentlemen listed Thammasat University on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedSmartply Europe | Ireland | 10 Feb 2026 | Manufacturing | Ransomware | The Gentlemen | Claimed. TheGentlemen listed the Coillte-owned panel maker on its leak site. No company statement found. | ransomware.live✓ 8 Nov |
 ⚠️ ClaimedPLUS MalaysiaSelangor | Malaysia | 6 Feb 2026 | Transport | Ransomware | The Gentlemen · Qilin | Claimed. The Gentlemen listed the highway operator on 6 February and Qilin listed it again on 1 March. | ransomware.live (The Gentlemen) · ransomware.live (Qilin)✓ 7 Nov |
| ⚠️ ClaimedChonburi Provincial Administration | Thailand | 6 Feb 2026 | Government | Ransomware | The Gentlemen | Claimed. The Gentlemen listed a Chonburi provincial administration (chon.go.th) on its leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedWells Fargo Kenya (courier and security) | Kenya | 6 Feb 2026 | Transport | Ransomware | The Gentlemen | Claimed. The Gentlemen ransomware group listed fargo.co.ke on its leak site. | ransomware.live✓ 8 Nov |
 ⚠️ ClaimedKontena Nasional | Malaysia | 20 Jan 2026 | Transport | Ransomware | Qilin · The Gentlemen | Claimed. Qilin and The Gentlemen each listed Kontena Nasional Berhad on their leak sites on the same day. | ransomware.live (Qilin) · ransomware.live (The Gentlemen)✓ 7 Nov |
 ⚠️ ClaimedSASI JSC | Vietnam | 20 Jan 2026 | Other | Ransomware | The Gentlemen | Claimed. The Gentlemen listed SASI JSC on its leak site on 20 January 2026. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedDTI Foreign Trade Service Corps | Philippines | 11 Jan 2026 | Government | Ransomware | The Gentlemen | Claimed. The Gentlemen listed the DTI Foreign Trade Service Corps on its leak site on 11 January. | Ransomware.live (Philippines)✓ 7 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology