Gentlemen RaaS Leak Exposes 10% of 2026's Ransomware Victims

• •The Gentlemen RaaS operation leaked internal communications revealing its structure and tactics.
• •The group has claimed 328 victims in 2026, representing 10% of global ransomware incidents.
• •The leak was first posted on Exploit.in and later shared on multiple forums, leading to account bans.

On May 4, 2026, a leak of internal communications from The Gentlemen Ransomware-as-a-Service (RaaS) operation surfaced on underground forums. The leak, which included chats and backend data from November 2025 to April 2026, revealed the group's operational structure and targeting methods. The Gentlemen, active since September 2025, has claimed 328 victims in 2026, accounting for 10% of global ransomware claims. This leak mirrors a previous incident involving Black Basta and highlights the group's use of AI and affiliate models. KELA's data shows a 14.5% increase in ransomware claims compared to 2025, with The Gentlemen rapidly rising in prominence. The leak was initially posted by a user on Exploit.in and later shared on other forums, leading to a ban of the original account. The incident underscores the growing threat posed by emerging ransomware groups.