- Notorious ransomware group Gentlemen has claimed responsibility for attacking nearly two dozen new victims across North America, Europe, Asia, and Australia. The victims cut across various sectors, including defense, governments, healthcare, retail, and manufacturing.
- Some notable victims are Spanish Indra Group, German Thyssenkrupp Marine Systems and Atlas Elektronik, Japanese DHC Corporation, Pou Sheng International from Hong Kong, and Mackay Sugar from Australia.
- There is no proof of any such incidents since none of the alleged victims or investigators have officially acknowledged the claims.
The Gentlemen ransomware group reportedly listed 22 organizations on its dark web leak site as its latest ransomware attack victims.
This stands as one of the most aggressive ransomware campaigns we’ve seen so far in 2026. The latest targets cut across at least 12 countries, with multiple sectors taking the hit.
Gentlemen Claims High Profile Targets in Alleged Attacks
Spain’s Indra Group, a technology heavyweight that deals in defense, aerospace, and transportation systems, is among the big names in the list. Then there’s Germany’s Thyssenkrupp Marine Systems, along with its subsidiary Atlas Elektronik.
These companies aren’t small players; they build submarines, naval ships, and cutting-edge sonar gear that militaries around the world use.
Other big names include Japan’s DHC Corporation, Hong Kong-based Pou Sheng International, and Australia’s Mackay Sugar. Pou Sheng distributes major sporting brands like Nike and Adidas across Asia. Mackay Sugar operates one of Australia’s largest sugar businesses.
The group also listed the City of Boyne City in Michigan. Local governments remain common ransomware targets. They provide essential public services and often have limited cybersecurity resources.
Several law firms appeared on the list, too. These include Wacha Justen in Ohio and Israel’s Oron Law Firm. Healthcare was represented by France’s Centre Ophtalmologique d’Ermont.
The variety shows The Gentlemen targets based on opportunity. They don’t limit themselves to any single industry.
The targeting of healthcare organizations is driven by the high value of medical records. Analysis has found that patient data can sell for up to $300 on cybercrime markets.
Defense and Government Under Fire
The defense sector took a significant hit in this latest wave. Indra Group stands out as a particularly sensitive target because it provides technological solutions for defense, aerospace, and government clients.
Also, Atlas Elektronik is a major player in maritime defense technologies, producing sonar systems and underwater systems for submarines and warships. An attack on such a company poses national security threats.
According to German press reports, Atlas Elektronik is the likely Thyssenkrupp subsidiary that was attacked. Yet, neither company made any official confirmation of this attack.
The local government also made the list. Michigan’s city of Boyne City has recently faced a cyber attack that disrupted the city’s computer and email systems. The city officials have reached out to the FBI to help investigate the issue.
The attack disrupted daily operations at city hall. Staff lost access to their computers and email. Officials said emergency services remained unaffected.
One of 2026’s Most Active Ransomware Groups
The Gentlemen quickly became one of this year’s fastest-growing ransomware groups. They showed up in 2025 and, not long after, decided to ditch other ransomware-as-a-service operations. Now, they run their own affiliate programs.
Security experts revealed that this gang has claimed hundreds of attacks globally in 2026 alone. In this way, they have become one of the busiest ransomware gangs at present.
What is rather curious is that the criminal organization itself became a victim of the attack earlier this year. Security experts got access to internal chats, negotiation documents, and operational records of the group.
The leaked information shows that the group operates on the basis of stealing credentials and exploiting vulnerabilities in internet-facing devices. It uses a double extortion strategy involving both encrypting files and threatening to release stolen data.
Security experts estimate the gang is behind approximately 10% of all ransomware activity. They have listed victims in Thailand, the UK, Brazil, Germany, and India.
Victim Claims Need Verification
Like any ransomware leak site, these listings should be viewed with caution. Criminal groups sometimes pose as organizations before negotiations finish. They also post claims before independent investigators verify what happened.
Some victims later confirm data theft or encryption. Others deny any impact or report only limited incidents. For now, none of the newly listed organizations has publicly confirmed The Gentlemen’s claims.
This new wave of attacks really drives home an uncomfortable truth—no one is off-limits anymore. Ransomware crews now go after all kinds of organizations, from big defense contractors and manufacturers to hospitals, retailers, and even local governments.
The latest campaign aligns with the trend recorded throughout 2026. Ransomware groups these days are widening the net. The target is no longer just the regular corporate victims, and that means a lot more people are at risk. They are now targeting those organizations whose impact reaches out to the supply chain and other vital areas.
