Skip to content
FTAPI Data Breach Linked to The Gentlemen Ransomware Gang

FTAPI Data Breach Linked to The Gentlemen Ransomware Gang

First seen 30 Sep 2026, 15:26 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 1, 2026 at 15:02 UTC
  • •FTAPI confirmed a breach involving The Gentlemen ransomware gang.
  • •The attack affected one internal server, not customer systems or data.
  • •A countdown on the gang's leak site suggests an imminent data release.

FTAPI, a Munich-based file transfer platform, confirmed a data breach after the ransomware group The Gentlemen claimed responsibility. The attackers accessed one internal server but did not compromise customer systems or data. FTAPI isolated the affected systems and engaged forensic investigators to assess the incident. The breach was detected on September 14, and FTAPI has since notified customers and filed a criminal complaint. The Gentlemen has not provided specific details about the data allegedly stolen, and a countdown on their leak site indicates an activation in approximately five days. The method of access to the server remains unclear, with possibilities including unpatched vulnerabilities or spearphishing. FTAPI serves over 2,000 businesses and more than one million users across various sectors, including government and healthcare.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 44d ago How this analysis works

Timeline

2026-09-14
Breach detected
FTAPI identified unauthorized access to an internal server and ransomware deployment.
Heise.De
2026-09-29
Public confirmation of breach
FTAPI confirmed the breach and the involvement of The Gentlemen ransomware gang.
Heise.De
2026-09-30
Breach reported by FTAPI
FTAPI released a statement detailing the breach and the measures taken to mitigate it.
Cybernews

More articles in this cluster (3)

Following this threat?

Track Qilin and Ftapi in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 3

Common questions

What data was compromised?
FTAPI has not confirmed any specific data was compromised, stating customer systems were not affected.
How did the breach occur?
The method of access is unclear; it could involve unpatched vulnerabilities or spearphishing.
What steps has FTAPI taken?
FTAPI isolated affected systems, hired forensic investigators, and notified customers and authorities.