- Researchers at Check Point Research gained rare access into The Gentlemen’s backend after an in-house breach hit the ransomware gang in May 2026.
- The exposed systems revealed over 1,570 likely victims, far more than what the gang publicly displayed on its leak site.
- Despite the breach, The Gentlemen continued expanding, landing an official partnership with BreachForums just days later.
A ransomware gang that built its reputation on breaching other people’s systems just had its own operation turned inside out.
In May 2026, the Gentlemen group faced an in-house breach that gave researchers at Check Point Research (CPR) a direct look into how the gang operated behind closed doors.
The compromise exposed backend infrastructure, affiliate activity, operational tools, and the victim management environment the group relied on to run its attacks.
For a gang that spent months targeting organisations across multiple sectors worldwide, the exposure was the same kind of operational nightmare they routinely inflicted on others.
What the Breach Revealed
CPR’s technical analysis uncovered leaked internal chats and backend databases tied directly to the operation. Inside private channels linked to the gang, affiliates talked about attack schemes, EDR-killer tools, credential misuse, as well as entry to enterprise infrastructures.
Researchers also identified operational channels that affiliates used for tooling discussions, victim coordination, and infrastructure planning. Conversations referencing Fortinet systems, Cisco-related access, and NTLM relay techniques also appeared in the leaked material.
Beyond the communications, the exposed systems pointed to additional malware activity connected to the operation. Researchers identified SystemBC in the gang’s toolkit (malware basically associated with remote access, persistence, as well as traffic tunnelling during ransomware attacks).
The most striking detail, however, was the victim count. The gang’s public leak site displayed a fraction of the actual numbers. According to CPR, investigators connected more than 1,570 likely victims to the operation once the internal systems came into view.
How the Gentlemen Built and Ran Its Operation
The Gentlemen first appeared in 2025 and grew through a ransomware-as-a-service (RaaS) model. Under that structure, the core operators managed the ransomware platform while affiliates carried out the actual attacks and collected a share of each ransom payment.
CPR pinpointed that the gang gave affiliates a ninety percent (90%) revenue share. By industry standards, the split is unusually generous. That figure likely helped the gang attract experienced cybercriminals who had options elsewhere.
Researchers observed that The Gentlemen focused more on execution than technical novelty. The gang targeted internet-facing systems, disabled security tools after gaining initial access, and encrypted Windows, Linux, NAS, and ESXi environments. The approach was methodical rather than flashy, which made it effective across a range of targets in different sectors.
The threat of dark web data leaks is a common extortion tactic. A ransomware gang recently threatened to leak 80,000 Money Mart financial files, showing how these groups pressure victims into paying ransoms.
The Gang Keeps Moving After the Leak
The internal breach did not slow The Gentlemen down for long. On May 16, the new BreachForum admins disclosed that the bad group had officially partnered with the forum. The partnership gave The Gentlemen advertising access on the platform along with infrastructure and operational support from the forum itself.
While the relationship remained publicly unconfirmed at first, Hackread.com later observed The Gentlemen displaying a BreachForums banner directly on its official dark web onion site. That site serves as the gang’s primary portal for publishing victim announcements and extortion updates, making the banner a visible and deliberate signal of the new arrangement.
The move suggests the group recalibrated quickly rather than retreating after the breach.
This incident adds to a growing pattern. Ransomware gangs project an image of tight organisation and operational discipline, but internal failures continue to create openings. Affiliate disputes, poor infrastructure security, insider leaks, and basic operational mistakes regularly hand researchers and law enforcement the intelligence they need to map out criminal networks.
The Gentlemen’s breach did not shut the group down. What it did do was pull back the curtain on an operation that had, until that point, kept its true scale hidden from public view.
