Privacy UnpackedRansomware gang
The Gentlemen (also tracked as Storm-2697)
Claims on its leak site since 9 September 2025, number 2 of all gangs in the last 12 months
- Claims, 12 months
- 959
- Last 30 days
- 118
- All claims
- 1,006
- Last claim
- 24 October 2026
Where its claimed victims are
Sectors
Claims matched to an official notice
4 organisations The Gentlemen claimed also filed a breach notice with a regulator, all of them after the claim. Matched by name: the notice does not say who the attacker was.
- The Kenaitze Indian Tribe
Claimed 31 July 2026 · notice filed with the US Department of Health and Human Services 25 September 2026 - Ayres Carr & Sullivan P.C
Claimed 1 July 2026 · notice filed with the Indiana Attorney General 25 September 2026 - CAZ Investments LP
Claimed 21 August 2026 · notice filed with the Indiana Attorney General 23 September 2026 - Advantage Home Health Care
Claimed 17 July 2026 · notice filed with the US Department of Health and Human Services 25 August 2026
What a claim is, and is not
A claim is a ransomware gang naming an organisation on its leak site, usually to pressure it into paying. It is the gang’s word: some claims are false, recycled from older breaches or exaggerated, and a claim says nothing about whose personal data, if any, was taken. That is why we count claims but do not list the organisations, and why a breach goes on the tracker as confirmed only when the organisation or a regulator says so.
How this is counted
Claims as collected from the gangs’ leak sites by ransomware.live, which says itself that they are unverified. We read its list every day and keep only counts: by month, by the victim’s country and by sector (as ransomware.live classifies them). Matches with official notices are by the organisation’s name, from 30 days before the claim to a year after it, against California’s and Washington’s full breach registers and every official notice on the tracker. A match is not a confirmation rate: those registers only see breaches of their own residents, and names are written differently. We never link to or visit leak sites.
From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Found a mistake? Tell us and we correct it.