Through July 2026, Comparitech’s tracker recorded 675 attacks claimed by The Gentlemen ransomware group since September 2025, but only 72 confirmed by the targeted organizations. For January through July 2026 alone, it counted 600 claims and 68 confirmations. Those are different measures: a leak-site claim is not proof of an attack, and disclosed record counts are not an audited total of everything stolen. The available reporting also does not establish how much the group demanded or collected in ransoms.
How many attacks has The Gentlemen claimed?
Comparitech’s tracker counted 675 claims from September 2025 through July 2026. Its January–July 2026 subset contained 600 claims. These are listings attributed to the group, not a count of independently verified intrusions.
As an Amazon Associate I earn from qualifying purchases.
Comparitech marks an incident confirmed when the targeted organization publicly discloses a ransomware incident or acknowledges a cyberattack that matches the group’s claim. A claim without that acknowledgment remains unconfirmed: it could be false, undisclosed, or awaiting corroboration. The date a group posts a claim can also lag the underlying incident.
How many attacks have been confirmed, and how many records were breached?
The tracker’s claim, confirmation, and record figures cover different evidence and measures. The records are figures reported for confirmed attacks in the stated periods; they should not be treated as an audited total of all data stolen.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
| Period | Group claims | Confirmed by targeted organizations | Records reported breached in confirmed attacks |
|---|---|---|---|
| September 2025–July 2026 | 675 | 72 | 796,140 |
| January–July 2026 | 600 | 68 | 787,400 |
All figures in the table are Comparitech tracker totals reported in 2026. The shorter period falls within the longer one, so the two rows are overlapping snapshots, not separate totals to add together.
Which sectors and countries appear most often in the 2026 claims?
Sector claims
For January–July 2026, Comparitech listed 516 business claims, including 146 in manufacturing. It marked 42 business claims as confirmed, of which 14 were in manufacturing. These are tracker classifications and do not mean every organization in those sectors acknowledged an incident.
Rank #2
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Country claims
The same January–July tracker listed 126 claims in the United States, 37 in Thailand, 32 in France, and 26 in India. These are locations associated with claims, not confirmed national incident totals; the figures do not establish that activity was limited to those countries.
What do disclosed breach figures mean?
Organizations and breach notices can count different things: personal-data entries, people notified, or residents potentially affected. Those measures are not interchangeable, and a disclosed affected count is not necessarily a count of unique people or proof of the full volume of data exfiltrated.
Rank #3
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- MEDICUS SHUPPAN, Japan: Comparitech reported 641,000 affected personal-data entries. The tracker notes that entries may include duplicates.
- Caribbean Medical Center, Puerto Rico: 92,000 people were notified after the breach.
- Soniva Dental Care, Texas: 30,000 residents were potentially affected.
- Gator Cases, United States: Comparitech listed 1,171 affected records.
Comparitech also lists confirmed breach notifications involving JRK Property Holdings in the United States and Ecopetrol in Colombia. The figures above come from separate disclosures and use different definitions, so they should not be summed as a uniform measure of unique victims.
Why do other reports show different victim totals?
Check Point Research reported 166 victims claimed in the first quarter of 2026 in its Q1 snapshot. In a separate report based on research access to linked command-and-control telemetry, it identified more than 320 publicly listed victims and estimated more than 1,570 likely corporate victims as of April 20, 2026. The telemetry figure is an estimate, not an organization-confirmed count.
Rank #4
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Those Check Point figures use different dates and methods from Comparitech’s tracker. A leak-site snapshot, an estimate from telemetry, and victim-confirmed incidents should not be combined into a single attack total.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What is known about The Gentlemen’s ransom model?
Microsoft Threat Intelligence tracks the operators as Storm-2697 and describes The Gentlemen as a financially motivated ransomware-as-a-service operation: the operators maintain the platform while affiliates carry out attacks. Microsoft describes a double-extortion approach that combines encryption with data theft and a threat to publish stolen information.
Best Value
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
BGD e-GOV CIRT’s August 9, 2026 advisory reports that early development and intrusions date to mid-2025, with formal external affiliate availability beginning in September 2025. It says affiliates receive 90% of ransom proceeds. That is a reported division of proceeds within the criminal service, not the percentage victims pay or a measure of total ransom revenue.
Ransom demands and payments are not established
The reviewed group-specific reporting does not establish a reliable total, average, or median for The Gentlemen’s ransom demands or payments. The 90% affiliate share cannot be used to calculate those amounts, and broader ransomware payment statistics would not be a sound substitute for missing group-specific figures.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What technical capabilities have researchers described?
Microsoft’s May 28, 2026 analysis examines a Windows Go encryptor that uses per-file ephemeral Curve25519 keys with XChaCha20, along with multiple methods of lateral movement. BGD e-GOV CIRT describes related payload capability for Windows, Linux, NAS, BSD, and VMware ESXi. These reports describe observed or reported capabilities; they do not establish that every victim had every listed system encrypted.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For defenders, Microsoft’s analysis includes mitigation guidance, Defender detections, hunting queries, and indicators of compromise. BGD e-GOV CIRT advises reviewing internet-facing infrastructure and backup resilience. These are defensive measures, not a guarantee that an organization can prevent or recover from every attack.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
