Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Active · #7 by victimsRansomware group

The Gentlemen

As of Oct 19, 2026, The Gentlemen has listed 985 confirmed victims on its leak site since Feb 19, 2025, 3.1% of all victims tracked by Brandefense. Its most targeted country is United States (24.6% of its victims) and its most targeted sector is Manufacturing.

The Gentlemen is a RaaS group that emerged in July-August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.

Also known asStorm-2697
Is My Company Listed?Follow The GentlemenRequest IOC FeedTTPs, CVEs and malware →

Follow and IOC feeds are part of the Brandefense platform.

Confirmed Victims
985
Rank By Victims
#7
Last Leak-Site Post
Oct 16, 2026
Top Country
United States
Top Sector
Manufacturing

Victims Posted Per Month.

The Gentlemen confirmed victims per month
MonthConfirmed victims
November 202514
December 20258
January 202634
February 202681
March 202657
April 202686
May 202676
June 2026117
July 2026136
August 2026114
September 2026105
October 2026 (month in progress)85
Updated continuously · figures as of Oct 19, 2026

Latest The Gentlemen Victims.

Search all 985 →
Latest confirmed leak-site victims claimed by The Gentlemen
VictimCountryIndustryData claimedPosted
AirQ
airq-ad.com
AEUnited Arab EmiratesTransportation and LogisticsNot stated
First Dental Health
firstdentalhealth.com
USUnited StatesHealthcareNot stated
Gio Dental Med Spa
giodentalspa.com
MXMexicoHealthcareNot stated
Wellington College International School Bangkok
wellingtoncollege.ac.th
THThailandEducation and ResearchNot stated
Ecuadors National Police
policia.gob.ec
ECEcuadorGovernment and Public SectorNot stated
Santa Barbara Endodontics
sbendo.com
USUnited StatesHealthcareNot stated

How They Operate.

The Gentlemen's threat actor profile lists 42 ATT&CK techniques, 1 exploited CVEs, 52 malware and tools, with its targets and related actors.

TTPs, CVEs and malware →

Who The Gentlemen Targets.

Sectors

  1. Manufacturing15715.9%
  2. Technology11611.8%
  3. Consulting10010.2%
  4. Education and Research808.1%
  5. Healthcare798.0%

Countries

  1. USUnited States24224.6%
  2. THThailand474.8%
  3. FRFrance424.3%
  4. BRBrazil363.7%
  5. INIndia363.7%
Shares are of this group's confirmed victims.

History.


  1. First confirmed victim listed on its leak site

  2. First seen in Brandefense data

  3. Busiest month on record: 136 confirmed victims

  4. Most recent leak-site post

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.