iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Comparitech counted 675 attacks claimed by The Gentlemen ransomware group from September 2025 through July 2026, of which 72 were confirmed by the targeted organizations. For January through July 2026 alone, it counted 600 claims and 68 confirmations. Those figures measure different things: a group’s listing is an allegation, while a confirmation requires an organization to disclose a ransomware incident or acknowledge a matching cyberattack.
What the attack statistics count
The figures below are dated snapshots, not a live total. Comparitech’s tracker covers claims posted by the group and separately records incidents that meet its confirmation standard. A claim that has not been confirmed might be false, might involve an organization that has not disclosed an incident, or might not yet be corroborated. The timing of a group’s claim can also lag the actual incident.
Comparitech marks an incident confirmed when the targeted organization publicly discloses a ransomware incident or acknowledges a cyberattack that matches the group’s claim. Confirmation does not make every claim on the group’s leak site a verified attack, and the tracker’s disclosed-record totals are not an audited count of all data stolen.
How many attacks has The Gentlemen claimed?
Comparitech counted 675 claims from September 2025 through July 2026. Its shorter January–July 2026 window accounts for 600 of those claims. Check Point Research reported a different snapshot: 166 claimed victims in Q1 2026. That figure reflects Check Point’s period and leak-site snapshot, so it should not be added to or substituted for Comparitech’s tracker totals.
#1 Best Overall
- No Additional Cost: You pay nothing for repairs – parts, labor, and shipping included.
- Coverage: Plan starts on the date of purchase. Malfunctions covered after the manufacturer's warranty. Power surges covered from day one. Plan includes food loss reimbursement up to $250 per approved claim for refrigerators & freezers and laundry services reimbursement up to $25 per approved claim for washers & dryers that are out for service for more than seven (7) consecutive days.
- Easy Claims Process: File a claim anytime online or by phone. Most claims approved within minutes. If we can’t repair it, we’ll send you an Amazon e-gift card for the purchase price of your covered product or replace it.
- Product Eligibility: Plan must be purchased with a product or within 30 days of the product purchase. Pre-existing conditions are not covered.
- Terms & Details: More information about this protection plan is available within the “Product guides and documents” section. Simply click “User Guide” for more info. Terms & Conditions will be available in Your Orders on Amazon. Asurion will also email your plan confirmation with Terms & Conditions to the address associated with your Amazon account within 24 hours of purchase.
| Measure | Period | Comparitech figure |
|---|---|---|
| Claims posted by the group | September 2025–July 2026 | 675 |
| Claims posted by the group | January–July 2026 | 600 |
| Claims confirmed by victim entities | September 2025–July 2026 | 72 |
| Claims confirmed by victim entities | January–July 2026 | 68 |
The confirmation figures are counts of matching incidents acknowledged by targeted entities, not a measure of how many claims the group may have made privately or how many organizations experienced an undisclosed intrusion.
How many records were reported breached?
Comparitech reported 787,400 breached records across confirmed attacks in January–July 2026 and 796,140 across confirmed attacks from September 2025 through July 2026. These are the tracker’s reported figures for those periods. They describe records reported as breached in confirmed incidents; they should not be read as an independently audited total of all information the attackers obtained.
Individual breach notices use different units and definitions, so the figures do not necessarily represent unique people and should not be added together as if they did. Comparitech lists several examples:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #2
- XGS 108W with 1 Year Standard Protection - Next-generation firewall appliance with Standard Protection subscription providing firewall, VPN, intrusion prevention, web security, and application control, managed through Sophos Central for unified policies and reporting.
- Wi Fi 6 plus 6 x 2.5 GE copper ports and 1 SFP fiber port, supporting up to 12.5 Gbps firewall performance for hybrid wired and wireless environments.
- Protects users from ransomware, malware, phishing, and intrusion attempts before they reach endpoints or applications.
- SD-WAN features deliver reliable, optimized application performance and intelligent multi link failover.
- Includes Standard Protection – Comprehensive security package with firewall, intrusion prevention, VPN, web security, and application control to defend against everyday threats and keep business operations safe.
- MEDICUS SHUPPAN, Japan: 641,000 affected personal-data entries reported. Comparitech notes that entries may include duplicates.
- Caribbean Medical Center, Puerto Rico: 92,000 people were notified after the breach.
- Soniva Dental Care, Texas: 30,000 Texas residents were potentially affected.
- Gator Cases, United States: 1,171 affected records were reported.
Comparitech also lists confirmed breach notifications involving JRK Property Holdings in the United States and Ecopetrol in Colombia. The counts above reflect the respective organizations’ or tracker’s reported measures; “people notified,” “people potentially affected,” and “data entries” are not interchangeable.
Which sectors and countries appear most often in the 2026 claims?
In its January–July 2026 data, Comparitech counted 516 business claims, including 146 claims involving manufacturers. It listed 42 business claims and 14 manufacturing claims as confirmed. These are claim counts by sector, not confirmed-incident totals, and the categories do not imply that every listed organization disclosed an attack.
The tracker’s leading country counts for claims in the same period were:
Rank #3
- XGS 108 with 1 Year Standard Protection - Next-generation firewall appliance with Standard Protection subscription providing firewall, VPN, intrusion prevention, web security, and application control, managed through Sophos Central for unified policies and reporting.
- 6 x 2.5 GE copper ports and 1 SFP fiber port, supporting up to 12.5 Gbps firewall performance for growing business networks.
- Protects users from ransomware, malware, phishing, and intrusion attempts before they reach endpoints or applications.
- SD-WAN features deliver reliable, optimized application performance and intelligent multi link failover.
- Includes Standard Protection – Comprehensive security package with firewall, intrusion prevention, VPN, web security, and application control to defend against everyday threats and keep business operations safe.
| Country | Claims, January–July 2026 |
|---|---|
| United States | 126 |
| Thailand | 37 |
| France | 32 |
| India | 26 |
These are geographic counts of claims in Comparitech’s tracker, not a ranking of independently confirmed attacks or a complete map of the group’s activity. The listed countries show that the operation’s claims are not confined to one national market.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What is known about ransoms?
The reviewed group-specific sources do not establish a reliable total, average, or median for ransom demands or payments attributed to The Gentlemen. The available monetary statistic is a reported affiliate revenue split: BGD e-GOV CIRT says affiliates receive 90% of ransom proceeds. Check Point Research also reports that split. It describes how proceeds are divided within the criminal service, not how much victims were asked to pay or actually paid.
Without dependable group-specific demand and payment data, broader ransomware payment figures would not answer how much The Gentlemen has collected. The 90% share should not be mistaken for a victim payment rate or a measure of the group’s total revenue.
Rank #4
- XGS 88W with 1 Year Standard Protection - Next-generation firewall appliance with Standard Protection subscription providing firewall, VPN, intrusion prevention, web security, and application control, managed through Sophos Central for unified policies and reporting.
- Built in Wi Fi 6 with 4 x 2.5 GE copper ports, delivering up to 9.9 Gbps firewall performance for secure wired and wireless networks.
- Protects users from ransomware, malware, phishing, and intrusion attempts before they reach endpoints or applications.
- SD-WAN features deliver reliable, optimized application performance and intelligent multi link failover.
- Includes Standard Protection – Comprehensive security package with firewall, intrusion prevention, VPN, web security, and application control to defend against everyday threats and keep business operations safe.
How the operation works—and what the technical reports establish
Microsoft Threat Intelligence tracks the operators as Storm-2697 and describes The Gentlemen as a financially motivated ransomware-as-a-service operation. In that model, operators maintain the service and affiliates carry out attacks. Microsoft describes double extortion: attackers encrypt systems while exfiltrating data, then use the threat of public release to pressure victims.
Microsoft’s May 28, 2026 analysis describes a Windows Go encryptor that uses per-file ephemeral Curve25519 keys with XChaCha20 and discusses lateral-movement methods. BGD e-GOV CIRT’s August 9, 2026 advisory describes reported payload capability across Windows, Linux, network-attached storage, BSD, and VMware ESXi. These are reported capabilities; they do not establish that every victim had every type of system encrypted.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →BGD e-GOV CIRT says the operation’s early development and intrusions date to mid-2025, with formal external affiliate availability beginning in September 2025. Check Point Research reported more than 320 publicly listed victims and more than 1,570 likely corporate victims identified in linked command-and-control telemetry as of April 20, 2026. The telemetry figure is an estimate based on Check Point’s research access, not an entity-confirmed victim count, and it is not directly comparable with Comparitech’s claim or confirmation totals.
What organizations can take from these figures
For defenders, the distinction between public claims and confirmed incidents matters: a listing can be a warning signal, but it is not by itself proof of a breach. Microsoft’s technical analysis includes mitigation guidance, Defender detections, hunting queries, and indicators of compromise. BGD e-GOV CIRT recommends reviewing internet-facing infrastructure and backup resilience. These materials address defense and detection; the published statistics do not establish that any single measure prevents or recovers every attack.
Sources: Comparitech, updated August 20, 2026, with tracker figures primarily through July 2026; Microsoft Threat Intelligence, May 28, 2026; Check Point Research, Q1 2026 and April 20, 2026; BGD e-GOV CIRT, August 9, 2026.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
