Apteki Mareshki listed on thegentlemen ransomware leak site

• Ransomware group: thegentlemen
• Country: Bulgaria
• Sector: Healthcare
• Announcement date: September 15, 2026

Bulgarian pharmacy chain targeted by thegentlemen

The Bulgarian pharmacy chain Apteki Mareshki has been listed on the leak site of the threat actor group known as thegentlemen. According to an announcement made by the group, they claim to have successfully compromised the organization's systems and exfiltrated data belonging to the entity.

Details of the claimed attack

The threat actor group thegentlemen published a post on September 14, 2026, alleging that they have gained unauthorized access to the systems of Apteki Mareshki. This announcement, which was subsequently posted on their leak site on September 15, 2026, suggests that the organization's digital assets may be at risk due to this unauthorized access.

In modern cyberattacks, particularly those involving ransomware, threat actors often employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information before the encryption process begins. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying a ransom. While the specific details of the breach remain unconfirmed by the victim, the presence of a listing on a leak site is a significant indicator of potential data exposure.

Information regarding the leaked data

Regarding the specific content of the alleged breach, the nature of the leaked data has not been specified by the group. No screenshots or specific file lists have been provided to substantiate the claims of the theft. Consequently, the exact scope and content of the compromised information remain unknown at this time.

About Apteki Mareshki

Apteki Mareshki is one of the largest pharmacy chains in Bulgaria, with a history dating back to its establishment in 1991. Based in Varna, the company is a major player in the retail pharmaceutical and distribution sector. The organization maintains a significant presence across the country, operating hundreds of locations to serve its customer base.

Potential risks and industry implications

This incident indicates that the organization may face the risk of exposure regarding customer and employee data. If the leaked information includes personal health records or financial data, legal consequences under the EU General Data Protection Regulation (GDPR) could arise. Furthermore, the exposed information may create a foundation for identity theft or targeted phishing attacks against the individuals involved.

Beyond the immediate impact on the organization, secondary risks to the supply chain and business partners may be observed. In the healthcare sector, the sensitivity of data makes organizations a high-value target for cybercriminals. When a major distributor or retail pharmacy is targeted, the ripple effects can extend to medical suppliers, healthcare providers, and the patients who rely on their services.

To mitigate such risks, organizations in the healthcare and pharmaceutical sectors typically focus on several defensive strategies. These include implementing robust multi-factor authentication (MFA) across all remote access points, maintaining rigorous patch management schedules to close vulnerabilities, and conducting regular employee training to recognize phishing attempts. Additionally, maintaining offline, immutable backups and implementing strict network segmentation can help limit the lateral movement of an attacker within a network, potentially preventing a full-scale data exfiltration event.

• Information about the group is limited.