TheGentlemen

Active
734 victims named on the leak site
137 in the last 30 days
721 in the last 12 months
Jan 2025 first victim we recorded
Aug 14, 2026 most recent victim posted
2 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

14.3% of TheGentlemen victims whose domain we can identify (105 of 734) had employee credentials leak in the 12 months before TheGentlemen named them as a victim.

We don't know whether any of these credentials were how TheGentlemen gained initial access.

What industries TheGentlemen targets

Sector identified for 588 of 734 victims.

Manufacturing160
Healthcare69
Financial Services68
Construction58
Technology49
Education28
Logistics28
Government23

Where the victims are located

Country identified for 662 of 734 victims.

United States158
France40
Thailand34
India29
Germany27
Brazil25
Italy24
Canada20

Most recent TheGentlemen victims

VictimSectorCountryPosted
Gfeller Treuhand und Verwaltungs gfeller-treuhand.chFinancial ServicesSwitzerlandAug 14, 2026
IPS ipssrl.comManufacturingItalyAug 14, 2026
Safeware safewareinc.comNot identifiedUnited StatesAug 13, 2026
INKA Group inka-holding.deFinancial ServicesGermanyAug 12, 2026
Zion Contracting zioncontracting.comConstructionUnited StatesAug 11, 2026
AIMS Group aimsgroup.comGovernmentUnited Arab EmiratesAug 10, 2026
AnMed anmed.orgHealthcareUnited StatesAug 10, 2026
Applied Business Investments appliedbizinvest.comFinancial ServicesUnited StatesAug 10, 2026
Axson Teknik axson.seManufacturingSwedenAug 10, 2026
aZaaS azaas.comNot identifiedSingaporeAug 10, 2026
BPCE International bpce-vietnam.comFinancial ServicesVietnamAug 10, 2026
Canopy Support Services canopysupport.caNon-profitCanadaAug 10, 2026
Contac Ingenieros contac.clManufacturingChileAug 10, 2026
Eva Care Group evacare.comHealthcareUnited StatesAug 10, 2026
Feraboli Zootech feraboli.itAgricultureItalyAug 10, 2026
Gödöllő Ingatlanközpont godolloi.huConstructionHungaryAug 10, 2026
Hartfiel Automation hartfiel.comManufacturingUnited StatesAug 10, 2026
Hiwin hiwin.itManufacturingItalyAug 10, 2026
Hong Kong Baptist University hkbu.edu.hkEducationNot identifiedAug 10, 2026
Hoang Chiropractic Center hoangchiro.comHealthcareUnited StatesAug 10, 2026

Showing the 20 most recent of 734. Browse recent data breaches for more.

TheGentlemen leak sites

Addresses we've seen TheGentlemen publish victims from. Any .onion address needs the Tor Browser.

  • tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion
  • lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion

TheGentlemen questions

Is TheGentlemen still active?

Yes. TheGentlemen posted its most recent victim on August 14, 2026. That's 137 victims in the last 30 days.

How many victims has TheGentlemen claimed?

TheGentlemen has named 734 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 721 of them were posted in the last 12 months.

When did TheGentlemen first appear?

The first victim we recorded for TheGentlemen was posted on January 2, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does TheGentlemen target?

Manufacturing accounts for the most victims we can classify, with 160. Healthcare follows at 69. We could identify a sector for 588 of 734 victims, so treat this as the shape of the targeting rather than a full census.

Has TheGentlemen already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.