TheGentlemen

Active
907 victims named on the leak site
110 in the last 30 days
852 in the last 12 months
Jan 2025 first victim we recorded
Oct 1, 2026 most recent victim posted
2 leak sites tracked

Data as of October 1, 2026.

Credential exposure before the attack

15.1% of TheGentlemen victims whose domain we can identify (137 of 907) had employee credentials leak in the 12 months before TheGentlemen named them as a victim.

We don't know whether any of these credentials were how TheGentlemen gained initial access.

What industries TheGentlemen targets

Sector identified for 717 of 907 victims.

Manufacturing188
Financial Services81
Healthcare81
Construction77
Technology60
Logistics35
Education32
Retail32

Where the victims are located

Country identified for 821 of 907 victims.

United States201
France44
Thailand36
India34
Italy33
Brazil32
Germany30
Canada24

Most recent TheGentlemen victims

VictimSectorCountryPosted
Aware aware.comTechnologyUnited StatesOct 1, 2026
Wooshin Systems wooshinsys.comManufacturingSouth KoreaOct 1, 2026
Zelham zelham.comConstructionUnited StatesOct 1, 2026
AGOSPAP agospap.comNon-profitFranceSep 30, 2026
Auren auren.esNot identifiedSpainSep 30, 2026
Auto Holler autohoeller.atAutomotiveAustriaSep 30, 2026
Corswarem Group corswarem.euConstructionBelgiumSep 30, 2026
Custom Rx Shoppe Pharmacy customrxshoppe.comRetailUnited StatesSep 30, 2026
DBU Construction dbu-construction.comConstructionUnited StatesSep 30, 2026
DefenceBit defencebit.comTechnologyPortugalSep 30, 2026
Don Hierro donhierro.comManufacturingSpainSep 30, 2026
Drinks Wines & Spirits drinks.com.twNot identifiedTaiwanSep 30, 2026
Datacomm Services dscdatacomm.comTelecommunicationsUnited StatesSep 30, 2026
Edcon edcon.co.zaRetailSouth AfricaSep 30, 2026
Europrim Group euro-prim.comLogisticsRomaniaSep 30, 2026
GES Aprosep groupe-aprosep.comNot identifiedFranceSep 30, 2026
Guy José Bendaña-Guerrero & Asociados guybendana.comLegalNot identifiedSep 30, 2026
LegalWise South Africa legalwise.co.zaLegalSouth AfricaSep 30, 2026
Northern New Jersey Eye Institute nnjei.comNot identifiedUnited StatesSep 30, 2026
Pulmonary Services Group pulmonaryservicesgrouppr.comHealthcareNot identifiedSep 30, 2026

Showing the 20 most recent of 907. Browse recent data breaches for more.

TheGentlemen leak sites

Addresses we've seen TheGentlemen publish victims from. Any .onion address needs the Tor Browser.

  • tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion
  • lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion

TheGentlemen questions

Is TheGentlemen still active?

Yes. TheGentlemen posted its most recent victim on October 1, 2026. That's 110 victims in the last 30 days.

How many victims has TheGentlemen claimed?

TheGentlemen has named 907 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 852 of them were posted in the last 12 months.

When did TheGentlemen first appear?

The first victim we recorded for TheGentlemen was posted on January 2, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does TheGentlemen target?

Manufacturing accounts for the most victims we can classify, with 188. Financial Services follows at 81. We could identify a sector for 717 of 907 victims, so treat this as the shape of the targeting rather than a full census.

Has TheGentlemen already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.