During the first seven months of 2026, The Gentlemen carried out 2.8 ransomware attacks per day.
Since it first emerged in mid-2025, The Gentlemen has claimed responsibility for 675 ransomware attacks. 600 of these attacks occurred in 2026 (up to the end of July), making it the second-most dominant strain behind Qilin (771 victims in the first seven months of this year).
In the last two months, The Gentlemen’s activity significantly increased.
The Gentlemen operates a Ransomware-as-a-Service (RaaS) model. Experts say it formed when one of Qilin’s affiliates (ArmCorp) splintered off following a payment dispute. ArmCorp became The Gentlemen and offered its affiliates a cut of 90 percent of the ransom payments – far higher than the average of 70 or 80.
In May 2026, The Gentlemen announced a partnership with BreachForums. It said, “We are actively looking for skilled affiliates–teams, individual pentesters, and access brokers–to join our program and scale operations worldwide.” This, combined with The Gentlemen’s rumored exploitation of newer vulnerabilities such as CVE-2025-32433 and CVE-2025-33073, likely helped drive its significant increase in attacks from May onward.
Throughout 2026, 24 percent of The Gentlemen’s victims have been manufacturers. Its biggest portion of 2026 victims (21%) are located in the US. This is a far lower percentage than its closest rival, Qilin. This year, 47 percent of Qilin’s victims have been located in the US.
Key findings for 2026 so far:
From January 2026 to July 2026, The Gentlemen has claimed:
- 600 victims (68 of these attacks have been confirmed by the entity involved)
- 36 attacks on healthcare providers (8 confirmed)
- 32 attacks on government entities (12 confirmed)
- 16 attacks on the education sector (6 confirmed)
- 516 attacks on businesses (42 confirmed):
- 146 on manufacturers (14 confirmed)
- 68 on service-based businesses (2 confirmed)
- 55 on retailers (4 confirmed)
- 53 on tech companies (2 confirmed)
- 32 on finance companies (3 confirmed)
- 787,400 records were breached in the confirmed attacks
- The US accounts for the most attacks (126), followed by Thailand (37), France (32), India (26), Germany (21), and Brazil, Canada, and Italy (18 each)
The Gentlemen ransomware victims by sector & industry
The Gentlemen’s focus is on businesses (manufacturers in particular), but it has still claimed a large number of attacks on the three other sectors (governments, healthcare, and education). In fact, The Gentlemen’s claims across these sectors account for a large chunk of the overall attacks we logged up to the end of July 2026.
The Gentlemen accounts for 12 percent of all attacks on healthcare providers, 14 percent on government entities, and 13 percent on educational institutions.
The Gentlemen ransomware attacks on healthcare providers
Up to the end of July 2026, we noted 36 attacks on healthcare providers. Eight of these attacks have been confirmed and 122,000 records were breached across these confirmed attacks.
Three of the confirmed attacks took place in the US. In May 2026, up to 30,000 Texan residents were potentially affected following an attack on Soniva Dental Care’s remote desktop web services infrastructure. In August 2026, the group also claimed the incredibly disruptive July 2026 attack on AnMed. Hooke Laboratories recently started notifying victims of a breach following an attack in June 2026.
The other confirmed attacks took place in other countries:
- Unimed Anápolis, Brazil – January 2026: After confirming an attack on its systems on January 12, 2026, Unimed Anápolis said there was no evidence of a data leak.
- Hospital Caribbean Medical Center, Puerto Rico – February 2026: The HCMC confirmed it had contained an attack in early February and started notifying 92,000 people of a data breach in April.
- IntraCare, New Zealand – March 2026: The attack started on March 20 and medical procedures were resumed on March 30. Patients involved in the breach are being notified (number affected unclear).
- Rajagiri Hospital, India – March 2026: The hospital confirmed its attack started via a phishing email and that 800 GB of data was stolen in the process.
- Wielkopolskie Centrum Medyczne REMEDIUM sp. z o.o., Poland – May 2026: The Polish hospital confirmed a breach of its systems had occurred in late May and that a broad group of patients had been impacted in the breach.
A large portion of the unconfirmed attacks (15 of the 28) hit organizations in the US.
The Gentlemen ransomware attacks on government agencies
In the first seven months of 2026, The Gentlemen claimed 32 attacks on government organizations. 12 of these attacks have been confirmed.
Two of the attacks were confirmed in the US – The City of Boyne City in May 2026 and the Kenaitze Indian Tribe in July 2026.
Elsewhere, the systems of Anderlues la Commune in Belgium were paralyzed for nearly a month following an attack in April 2026, and a town hall in the Czech Republic (Náměšť nad Oslavou) hoped to recover its systems within a week after its attack in March 2026.
Other targets:
- Witzenberg Municipality in South Africa – January 2026
- The Spanish municipality of Beniel – January 2026
- Chile’s National Institute for Human Rights (Instituto Nacional de Derechos Humanos) – February 2026
- The social security fund in Panama (Caja de Seguro Social – CSS) – March 2026
- Croatia’s Ministry of Health (Ministarstvo zdravstva Republike Hrvatske) – June 2026
- Denmark’s national museum (Nationalmuseet) – June 2026
- A voluntary fire brigade (Feuerwehr Allensbach) in Germany – June 2026
- Metro Mondego, a public transport company in Portugal – July 2026
The unconfirmed attacks took place across 15 different countries.
The Gentlemen ransomware attacks on the education sector
From January to July 2026, The Gentlemen added 16 schools, colleges, and universities to its data leak site. Six of these attacks were confirmed.
Two universities in Brazil confirmed attacks in February 2026 – Centro Universitário Filadélfia (UniFil) and Universidade Federal de Sergipe.
A further two attacks were confirmed in February. CHS Villach in Austria confirmed a data breach following its attack, while Sasin School of Management in Thailand said that there was no evidence that critical data systems had been compromised in its attack.
An attack on Vysoká škola finanční a správní (University of Finance and Administration) in the Czech Republic in May 2026 and one in June 2026 at Akademia Leona Koźmińskiego – Kozminski University in Poland were also confirmed.
Three further unconfirmed attacks took place in Brazil, two in Thailand, and one each in Argentina, Brazil, India, Israel, and Pakistan.
The Gentlemen ransomware attacks on businesses
In the first seven months of 2026, The Gentlemen took credit for 516 attacks on businesses. 42 were confirmed.
As previously noted, most of the confirmed attacks were on manufacturers. Here, 14 were confirmed with four taking place in Japan (Nishiyama Seisakusho Co., Ltd. in January 2026, Omikenshi Co., Ltd. in March 2026, Oriental Diamond Co., Ltd. in May 2026, and Koa Glass Co., Ltd. in May 2026).
The others were:
- HAFA, France – January 2026
- Wamtechnik sp. z o.o., Poland – January 2026
- Heinrich Kopp GmbH, Germany – April 2026
- Gem Terminal Industry Co., Ltd., Taiwan – April 2026
- Arçelik A.Ş., Turkey – April 2026
- Gator Cases, LLC, US – April 2026
- IP Rings Limited, India – May 2026
- Indra Group (subsidiary), Spain – June 2026
- TKMS ATLAS North America, LLC, US – June 2026
- HIWIN S.r.l., Italy – July 2026
The Gentlemen’s most targeted countries
This year so far, The Gentlemen’s most targeted countries are:
- United States – 126 attacks (8 confirmed)
- Thailand – 37 attacks (1 confirmed)
- France – 32 attacks (4 confirmed)
- India – 26 attacks (2 confirmed)
- Germany – 21 attacks (3 confirmed)
- Brazil – 18 attacks (3 confirmed)
- Canada – 18 attacks (none confirmed)
- Italy – 18 attacks (1 confirmed)
- Taiwan –17 attacks (2 confirmed)
- Poland – 15 attacks (6 confirmed)
- Japan – 15 attacks (9 confirmed)
Confirmed data breaches following ransomware attacks via The Gentlemen
The following entities confirmed data breaches following ransomware attacks via The Gentlemen:
- MEDICUS SHUPPAN, Publishers Co., Ltd, Japan – 641,000 affected: In March 2026, the publishing company was targeted in an attack. 641,000 entries of personal data were affected, which may include some duplicate entries for the same person.
- Hospital Caribbean Medical Center, Puerto Rico – 92,000 affected: The Puerto Rican medical center was targeted in February 2026 and later issued data breach notifications to 92,000 people.
- Soniva Dental Care, United States – 30,000 affected: Access to patient data couldn’t be ruled out in this May 2026 attack with around 30,000 people in Texas impacted.
- JRK Property Holdings, Inc., United States – 19,919 affected: In March 2026, the property investment company noted suspicious activity on its systems. It later notified nearly 20,000 people across 7 states of a breach (the total figure is unknown).
- Ecopetrol S.A., Colombia – 3,300 affected: Having suffered an attack in July 2026, the Colombian petroleum company confirmed 3,300 user accounts could have been affected.
- Gator Cases, LLC, United States – 1,171 affected: The US manufacturer issued data breach letters to nearly 1,200 people following its attack in April 2026.
The Gentlemen statistics from September 2025 to July 2026
Since The Gentlemen first started adding victims to its data leak site in September 2025, we’ve recorded:
- 675 attacks via The Gentlemen
- 72 of these attacks have been confirmed by the targeted entity
- 796,140 records have been breached across the confirmed attacks
- 33 attacks on government entities (13 confirmed)
- 20 attacks on the education sector (6 confirmed)
- 43 attacks on healthcare providers (9 confirmed)
- 579 attacks on businesses (44 confirmed)
Confirmed vs unconfirmed attacks
We label a ransomware attack as “confirmed” when a) the targeted organization publicly discloses an attack that involved ransomware, or b) the targeted organization publicly acknowledges a cyber attack that matches a claim made by a ransomware group. If a ransomware group claims that it successfully attacked an organization, but the organization never acknowledged an attack, then we label the attack as “unconfirmed.”
An attack might be unconfirmed because the ransomware group making the claim is lying, or because the targeted organization chose not to disclose the attack to the public. Ransomware groups post their attack claims on their respective websites, where the data is auctioned or released when organizations don’t meet their ransom demands.
Organizations in the US are required to disclose data breaches, which often result from ransomware attacks, to state officials when they meet certain thresholds. Not all countries have breach disclosure laws.
When an attack is confirmed, it is removed from our list of unconfirmed attacks. Therefore, we must allow for some changes in figures when comparing monthly figures, especially when using unconfirmed attacks. Claims from ransomware groups often come about a month after the attack, if not longer. For example, if a ransomware gang claims an attack in January 2025, it may later be confirmed as an attack in December 2024 and will, therefore, be attributed to a different month.
All data is derived from our worldwide ransomware tracker (updated daily) – here.