thegentlemen
Known ransomware group ACTIVE Active · high-tempo
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
38
Total Claims
19
Critical
—
Records Claimed
12
Industries Hit
Active span: Apr 26, 2026 – Oct 9, 2026 · 38 organizations targeted
Active · high-tempo
Actor Threat Profile
Activity Timeline
Peak: May 2026 (11)Apr 2026
LessMore
Oct 2026Share this profile
Top Targeted Industries
Healthcare 13
Education 7
Financial Services 5
Consumer Services 2
Professional Services 1
Other 1
Tradecraft & Infrastructure
0
Documented tools
12 / 56
MITRE tactics / techniques
2
Known leak sites
Targeted Organizations
MabrisAll Souls St Gabriels SchoolDeloitteSAS H2O MICHELUniversity of BuraimiHospital de la Santa Creu i Sant PauMandurah State Emergency ServiceWestrop Primary & Nursery SchoolEuroprimVUS - The English CenterANP HealthGuardriskAforpaPharmaEssentia CorporationAir CanadaMetroUniversity of San FranciscoCentral Arkansas PediatricsThe ClinicWCM RemediumInstitucion CervantesSuburban WaterDownriver Medical AssociatesEdgewood Surgical HospitalMichigan Surgical CenterBrian Jessel BMWSanatorio DeltaLe Perreux sur MarneYMCA of ColumbiaInternal MedicineInternet Technologies DesignsUniversity of Finance and AdministrationRoss Yerger InsuranceAmstel SecuritiesShajarpak SecuritiesValue Exchange InternationalDermaPharmEEC Group
Claims by thegentlemen
Low
Ransomware Claim: Mabris
Mabris
thegentlemen
Ransomware
Oct 11, 2026 Low
Ransomware Claim: All Souls St Gabriels School
All Souls St Gabriels School
thegentlemen
Ransomware Education
Oct 10, 2026 Low
Ransomware Claim: Deloitte
Deloitte
thegentlemen
Ransomware Professional Services
Oct 10, 2026 Low
Ransomware Claim: SAS H2O MICHEL
SAS H2O MICHEL
thegentlemen
Ransomware Other
Oct 10, 2026 Low
Ransomware Claim: University of Buraimi
University of Buraimi
thegentlemen
Ransomware Education
Oct 10, 2026 Critical
Ransomware Claim: Hospital de la Santa Creu i Sant Pau
Hospital de la Santa Creu i Sant Pau
thegentlemen
Ransomware Healthcare
Oct 3, 2026 Low
Ransomware Claim: Mandurah State Emergency Service
Mandurah State Emergency Service
thegentlemen
Ransomware Government & Defense
Oct 3, 2026 Low
Ransomware Claim: Westrop Primary & Nursery School
Westrop Primary & Nursery School
thegentlemen
Ransomware Education
Oct 3, 2026 Critical
Ransomware Claim: Europrim
Europrim
thegentlemen
Ransomware Healthcare
Sep 30, 2026 Low
Ransomware Claim: VUS - The English Center
VUS - The English Center
thegentlemen
Ransomware Education
Sep 30, 2026 Critical
Ransomware Claim: ANP Health
ANP Health
thegentlemen
Ransomware Healthcare
Sep 26, 2026 Critical
Ransomware Claim: Guardrisk
Guardrisk
thegentlemen
Ransomware Financial Services
Sep 26, 2026 Low
Ransomware Claim: Aforpa
Aforpa
thegentlemen
Ransomware
Sep 15, 2026 Critical
Ransomware Claim: PharmaEssentia Corporation
PharmaEssentia Corporation
thegentlemen
Ransomware Healthcare
Sep 11, 2026 Low
Ransomware Claim: Air Canada
Air Canada
thegentlemen
Ransomware Transportation
Sep 11, 2026 Low
Ransomware Claim: Metro
Metro
thegentlemen
Ransomware Retail & E-Commerce
Sep 11, 2026 Low
Ransomware Claim: University of San Francisco
University of San Francisco
thegentlemen
Ransomware Education
Sep 11, 2026 Critical
Ransomware Claim: Central Arkansas Pediatrics
Central Arkansas Pediatrics
thegentlemen
Ransomware Healthcare
Jun 8, 2026 Critical
Ransomware Claim: The Clinic
The Clinic
thegentlemen
Ransomware Healthcare
Jun 8, 2026 Critical
Ransomware Claim: WCM Remedium
WCM Remedium
thegentlemen
Ransomware Healthcare
Jun 8, 2026 Low
Ransomware Claim: Institucion Cervantes
Institucion Cervantes
thegentlemen
Ransomware Education
Jun 8, 2026 Critical
Ransomware Claim: Suburban Water
Suburban Water
thegentlemen
Ransomware Energy
Jun 7, 2026 Critical
Ransomware Claim: Downriver Medical Associates
Downriver Medical Associates
thegentlemen
Ransomware Healthcare
Jun 4, 2026 Critical
500 GB leaked Ransomware Claim: Edgewood Surgical Hospital
Edgewood Surgical Hospital
thegentlemen
Ransomware Healthcare
Jun 4, 2026 Critical
Ransomware Claim: Michigan Surgical Center
Michigan Surgical Center
thegentlemen
Ransomware Healthcare
Jun 4, 2026 Low
Ransomware Claim: Brian Jessel BMW
Brian Jessel BMW
thegentlemen
Ransomware Consumer Services
Jun 4, 2026 Critical
Ransomware Claim: Sanatorio Delta
Sanatorio Delta
thegentlemen
Ransomware Healthcare
May 24, 2026 Low
Ransomware Claim: Le Perreux sur Marne
Le Perreux sur Marne
thegentlemen
Ransomware
May 24, 2026 Low
Ransomware Claim: YMCA of Columbia
YMCA of Columbia
thegentlemen
Ransomware Consumer Services
May 21, 2026 Critical
Ransomware Claim: Internal Medicine
Internal Medicine
thegentlemen
Ransomware Healthcare
May 19, 2026 Low
Ransomware Claim: Internet Technologies Designs
Internet Technologies Designs
thegentlemen
Ransomware Technology
May 19, 2026 Low
Ransomware Claim: University of Finance and Administration
University of Finance and Administration
thegentlemen
Ransomware Education
May 19, 2026 Critical
Ransomware Claim: Ross Yerger Insurance
Ross Yerger Insurance
thegentlemen
Ransomware Financial Services
May 17, 2026 Critical
Ransomware Claim: Amstel Securities
Amstel Securities
thegentlemen
Ransomware Financial Services
May 13, 2026 Critical
Ransomware Claim: Shajarpak Securities
Shajarpak Securities
thegentlemen
Ransomware Financial Services
May 13, 2026 Critical
Ransomware Claim: Value Exchange International
Value Exchange International
thegentlemen
Ransomware Financial Services
May 13, 2026 Critical
Ransomware Claim: DermaPharm
DermaPharm
thegentlemen
Ransomware Healthcare
May 10, 2026 High
Ransomware Claim: EEC Group
EEC Group
thegentlemen
Ransomware Business Services
Apr 27, 2026