FTAPI data breach confirmed after The Gentlemen ransomware claim

FTAPI confirmed a security incident after The Gentlemen ransomware gang claimed it breached the file transfer platform.

The company says attackers reached one internal server, not customer systems or transferred data.

FTAPI isolated affected systems, hired forensic investigators, notified customers, and filed a criminal complaint.

The Gentlemen has not shown what data it claims to have taken from FTAPI yet.

Key Takeaways by nexos.ai , reviewed by Cybernews staff.

FTAPI, a key player in the European digital sovereignty push, has been attacked. The file transfer platform has confirmed the breach.

The cybercrime gang known as The Gentlemen has claimed to have breached FTAPI, a German platform used by thousands of organizations.

Based in Munich, FTAPI provides secure data exchange services to organizations that need to move sensitive files and information.

According to the company, more than 2,000 businesses use its services, and more than 1 million people across government, healthcare, and industry rely on the platform.

The claims appeared on the gang's leak site on the dark net. For now, the gang has offered little evidence of what type of data it may have taken.

A countdown on the listing currently shows roughly 5 days remaining before the alleged leak entry is due to "activate." As the platform handles data transfers, the allegedly stolen data could include a variety of sensitive information.

FTAPI confirms the data breach

The company has confirmed to German news outlet Heise Online that it suffered a security incident, but says the attack did not reach its customer platform or the data being exchanged through it.

According to the company, unauthorized individuals gained access to a single internally operated server at a local site and deployed ransomware on it.

FTAPI said it immediately isolated the affected systems and brought in an external forensic team to investigate what had happened.

The company said it subsequently informed customers and partners once it had established reliable initial findings.

It also said it had fulfilled relevant regulatory reporting obligations, including those relating to data protection, and filed a criminal complaint.

The company said its customer systems were not affected, nor was the data exchanged by customers through the service.

FTAPI has not disclosed how the attackers obtained access to the compromised server. At this stage, it’s unclear whether the systems were hacked by exploiting an unpatched software vulnerability or by stealing credentials.

One possibility would be spearphishing, in which attackers trick an employee into surrendering credentials or opening a malicious file.

What do we know The Gentlemen?

The gang relies on ransomware-as-a-service (RaaS) to profit and employs a double-extortion model. It splits revenue with affiliates who use its illicit infrastructure.

The Gentlemen originated as ArmCorp, a prolific affiliate cluster of the Qilin ransomware program, comprising approximately 20 members.

According to Halcyon security firm , the split between the gangs was triggered by a payment dispute on July 2nd, 2025, when the threat actor known as "hastalamuerte" filed a public arbitration complaint on the RAMP underground forum, alleging that Qilin owed roughly $48,000 in unpaid commission.

The first Gentlemen ransomware sample appeared on VirusTotal on July 17th, 2025. This was 5 days before the public dispute, with the leak site URL already hardcoded into the binary, indicating the separation was premeditated and already underway.

Researchers at ASEC, South Korean cybersecurity firm AhnLab’s threat intelligence and research division , are convinced that the gang’s technical sophistication suggests a coordinated team with extensive experience in enterprise-focused attacks.

The gang has listed quite a number of victims recently, including NATO contractor Indra , Dutch ice arena Thialf , LA Metro , and Glassdoor .

Europe is working on tech sovereignty

FTAPI is on the list of European tech companies providing digital services, which could serve as an alternative to US-based tech giants.

While US companies still dominate Europe’s cloud and workplace services, concerns data access and service disruption are prompting Europeans to look for alternatives.

“We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable, and our services secure,” said European Commission President Ursula von der Leyen, presenting the tech sovereignty package.

The package is designed to bolster European competitiveness while also reducing dependencies on United States-based services and companies.Countries and institutions across Europe are already switching, are committed to switch, or are considering European alternatives.

In the Cybernews interactive map, you can find European efforts to replace US technology with local alternatives mapped.