We've just wrapped up the new design, along with a ton of other improvements. Check them all out in the Changelog.

Ransomware Group intelligence

Thegentlemen

Active

Track Thegentlemen with 1056 published victims and 2 known leak locations in a single intelligence view.

DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Victims 1056 Known published victims in this dataset
First discovered 2025-09-09 Earliest victim discovery date
Last discovered 2026-10-30 Latest victim discovery date
Inactive since 0 days Days since the latest known victim
Top country United States 228 victims
Known locations 2 Leak or negotiation infrastructure tracked

Overview

Thegentlemen is tracked by Dark Eye as a ransomware group with 1056 published victims.

United States is currently the most targeted country in this dataset.

2 known leak locations are currently associated with this group.

Leak Status Distribution

  • Leaked 15 1.4%
  • Pending 1041 98.6%
  • Deleted 0 0.0%

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (2)

    Label Type Availability Links
    Leak location 1 Onion service Up checked 3h ago tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion
    Leak location 2 Onion service Down checked 3h ago i2ohjeeqe37jre4f2u7pyq73cbm6lecumdxapkvrlryna6rc3it4zsid.onion

    Top Activity Sectors (21)

    Victims (1056)

    Search, filter and paginate the victim timeline for Thegentlemen. Showing 401–500 of 1056.

    Type Target Discovered Country Business Category Intel Link Leak status
    Ransomware Advanced Marketing id30859 View details Mexico Communication / Marketing — pending
    Ransomware European Design id30780 View details Canada Retail / E-commerce — pending
    Ransomware MK Jewelry id30781 View details North Macedonia Retail / E-commerce — pending
    Ransomware GUERREIROS seguros id30782 View details Portugal Retail / E-commerce — pending
    Ransomware Tikona Infinet id30783 View details India Telecommunications — pending
    Ransomware TC Printing id30784 View details Australia Manufacturing / Engineering — pending
    Ransomware Oldelval Oleoductos del Valle id30785 View details Argentina Energy — pending
    Ransomware Decoupe Laser Services id30786 View details France Manufacturing / Engineering — pending
    Ransomware Thialf id30787 View details Netherlands Construction / Real Estate — pending
    Ransomware Title Resources id30788 View details Australia Finance / Legal / Insurance — pending
    Ransomware Clarke Radiology id30789 View details Australia Healthcare / Pharma — pending
    Ransomware SICSOE id30790 View details France IT — pending
    Ransomware Gloria Maris Groupe id30791 View details France Other — pending
    Ransomware Compagnie des Caoutchoucs du Pakidie id30792 View details Côte d'Ivoire Other — pending
    Ransomware HBS Group id30793 View details Australia Construction / Real Estate — pending
    Ransomware Agapit id30794 View details Poland IT — pending
    Ransomware Raben Group id30795 View details Poland Transportation / Travel / Logistics — pending
    Ransomware Henry Frerk Sons id30796 View details United States Manufacturing / Engineering — pending
    Ransomware SMRTR id30797 View details United States IT — pending
    Ransomware DayNDay id30798 View details India Retail / E-commerce — pending
    Ransomware Affinity Designs id30799 View details United States Construction / Real Estate — pending
    Ransomware Lenrose id30800 View details Australia Other — pending
    Ransomware Velum id30801 View details — IT — pending
    Ransomware Ceska filharmonie id30802 View details Czechia Services — pending
    Ransomware Herbahaz id30803 View details Hungary Agriculture / Food — pending
    Ransomware vpcgroup.com customfoam.com id30804 View details United States Manufacturing / Engineering — pending
    Ransomware Optiforms id30805 View details United States IT — pending
    Ransomware MatTek id30806 View details United States IT — pending
    Ransomware Conecsus id30807 View details United States IT — pending
    Ransomware Wunschkind Klinik Dr Brunbauer id30808 View details Austria Healthcare / Pharma — pending
    Ransomware Sirl id30764 View details Portugal IT — pending
    Ransomware Disney Family id30765 View details United States Finance / Legal / Insurance — pending
    Ransomware Ecopetrol id30672 View details Colombia Energy — leaked
    Ransomware Military Sealift Command id30646 View details United States Transportation / Travel / Logistics — pending
    Ransomware Advantage Home Health Care id30647 View details United States Healthcare / Pharma — pending
    Ransomware Sunway Scientific id30648 View details Taiwan, Province of China Manufacturing / Engineering — pending
    Ransomware Tangram Interiors id30614 View details United States Construction / Real Estate — pending
    Ransomware BRAC id30615 View details Bangladesh NGOs / Associations — pending
    Ransomware Customs Watch id30616 View details United States Retail / E-commerce — pending
    Ransomware Gallant id30617 View details Finland IT — pending
    Ransomware Hanseata id30618 View details Germany Finance / Legal / Insurance — pending
    Ransomware Metro Mondego id30595 View details Portugal Transportation / Travel / Logistics — pending
    Ransomware Comet Enterprise Corp id30596 View details Taiwan, Province of China Manufacturing / Engineering — pending
    Ransomware Landesbibliothek Coburg id30597 View details Germany Education — pending
    Ransomware ALUFE Femszerkezeti Kft id30598 View details Hungary Manufacturing / Engineering — pending
    Ransomware Tooltec id30599 View details Sweden Manufacturing / Engineering — pending
    Ransomware Terra Vitis id30600 View details France Agriculture / Food — pending
    Ransomware Vignobles Toutigeac id30601 View details France Other — pending
    Ransomware Dink Co Ltd id30602 View details Japan IT — pending
    Ransomware Lsn id30604 View details Poland IT — pending
    Ransomware Giraudi Group id30605 View details Italy — — pending
    Ransomware Mesto Celakovice id30606 View details Czechia — — pending
    Ransomware Kaneko id30607 View details Japan Manufacturing / Engineering — pending
    Ransomware Byggelit Sverige id30608 View details Sweden — — pending
    Ransomware Terry P Moosmann CPA PC id30609 View details United States — — pending
    Ransomware Royal Foods id30475 View details Australia Hospitality / Food & Beverage / Tourism — pending
    Ransomware Ferretería Scopazzo id30476 View details Argentina Retail / E-commerce — pending
    Ransomware Fortray id30477 View details — IT — pending
    Ransomware Martin Cava id30478 View details Spain Other — pending
    Ransomware Aveiro Constructors Limited id30479 View details Portugal Construction / Real Estate — pending
    Ransomware Triquesta id30480 View details Mexico IT — pending
    Ransomware Vicenzi Group id30481 View details Italy Agriculture / Food — pending
    Ransomware Energon id30482 View details Czechia Energy — pending
    Ransomware Open Options id30483 View details Ireland IT — pending
    Ransomware INTERNET AG id30484 View details Germany IT — pending
    Ransomware Crossroads Medical Management id30485 View details United States Healthcare / Pharma — pending
    Ransomware Pharma Wholesale id30486 View details United States Healthcare / Pharma — pending
    Ransomware Welders Supply Equipment Rentals id30487 View details United States Construction / Real Estate — pending
    Ransomware VASBE id30488 View details Russian Federation IT — pending
    Ransomware Gene Codes Forensics id30489 View details United States Healthcare / Pharma — pending
    Ransomware Lopes Law id30490 View details United States Finance / Legal / Insurance — pending
    Ransomware Carita id30491 View details France Retail / E-commerce — pending
    Ransomware BDO Greece id30492 View details Greece Finance / Legal / Insurance — pending
    Ransomware Dash Door Glass id30493 View details United States IT — pending
    Ransomware Shamrock Holdings Inc. id30327 View details United States IT — pending
    Ransomware Medic Rescue id30328 View details United States NGOs / Associations — pending
    Ransomware LogiQuip id30329 View details United Kingdom Manufacturing / Engineering — pending
    Ransomware Virginia Historical Society id30330 View details United States NGOs / Associations — pending
    Ransomware Quanterm Logistics Sdn Bhd id30331 View details Malaysia IT — pending
    Ransomware Spedidam id30332 View details France Services — pending
    Ransomware hiddeenn id30333 View details — Other — pending
    Ransomware Arabia Falcon Insurance Company SAOG id30334 View details Oman Finance / Legal / Insurance — pending
    Ransomware Ce Ratp Comite D entreprise Ratp id30335 View details France Other — pending
    Ransomware Keifert id30336 View details Germany Manufacturing / Engineering — pending
    Ransomware Kosmos id30337 View details Germany IT — pending
    Ransomware EBNY Development id30338 View details Egypt Retail / E-commerce — pending
    Ransomware Tonnies Group id30339 View details Germany Agriculture / Food — pending
    Ransomware Automovil Supply S.A id30340 View details Paraguay Retail / E-commerce — pending
    Ransomware Excel Cell Electronic id30341 View details Taiwan, Province of China Manufacturing / Engineering — pending
    Ransomware Mercado Libre id30342 View details Argentina Retail / E-commerce — pending
    Ransomware CSIR Structural Engineering Research Centre id30343 View details India Research — pending
    Ransomware Jump Solutions Inc id30344 View details Philippines IT — pending
    Ransomware MBT Energy id30345 View details Germany Energy — pending
    Ransomware Pro-Tech Technology id30347 View details Hong Kong Energy — pending
    Ransomware Technical Solutions Group id30348 View details United States IT — pending
    Ransomware Keywest Projects id30178 View details Canada Construction / Real Estate — pending
    Ransomware International Freight Services id30179 View details United States IT — pending
    Ransomware Royal Thai Navy Housing Cooperative id30180 View details Thailand Other — pending
    Ransomware CTM India Limited motherson INDIA id30181 View details India Finance / Legal / Insurance — pending
    Ransomware Hooke Laboratories id30182 View details United States IT — pending