Balkan Polymers listed on thegentlemen leak site

• Ransomware group: thegentlemen
• Country: Bulgaria
• Sector: Manufacturing
• Announcement date: September 15, 2026

The manufacturing company Balkan Polymers has been listed on a leak site by the threat actor known as thegentlemen. This announcement, made on September 15, 2026, follows a claimed attack date of September 14, 2026. The listing constitutes a claim by the threat actor regarding a data breach involving the organization.

The claims made by thegentlemen

The group known as thegentlemen has published a post claiming that data belonging to Balkan Polymers has been compromised. In their announcement, the group included specific details regarding the company's operations and its production capacity. This type of activity is common in modern ransomware campaigns, where threat actors utilize leak sites to pressure victims through the threat of public exposure.

In many such incidents, threat actors employ a strategy known as double extortion. This method involves not only encrypting an organization's systems to disrupt operations but also exfiltrating sensitive data to use as leverage. By threatening to release this information on a public or semi-public leak site, the attackers aim to increase the pressure on the victim to meet their demands. While the specific nature of the extortion in this case remains limited to the group's claims, the publication of operational details is a hallmark of this tactic.

Details regarding the claimed data

Despite the publication of the claim, the threat actor has not provided detailed evidence regarding how this data was obtained or which specific files were affected. At this stage, the listing names no specific data types or file lists.

The group has not provided any screenshots or file lists to clarify the nature of the compromised or threatened data. Furthermore, there is no information available regarding the total size of the data, the specific file count, or any ransom demand associated with this claim. The lack of concrete evidence makes it difficult to determine the exact scope of the alleged breach.

Common defensive steps for organizations

When organizations face such threats, common defensive steps often include conducting thorough forensic investigations to identify the entry point, implementing multi-factor authentication, and enhancing monitoring and logging capabilities. Organizations also frequently focus on regular offline backups and employee awareness training to mitigate the risks of initial access.

About Balkan Polymers

Balkan Polymers is a polymer recycling and granule production company founded in 2011 in Serbia. The company collects and processes plastic waste to produce rPP, rPE, and rPS granules. These products are utilized across several critical industries, including the packaging, automotive, and construction sectors.

Potential implications and risks

This incident suggests that Balkan Polymers' operational data and trade secrets may be at risk of exposure. Given the company's extensive supply chain in the European market and its EuCertPlast certification, the leak could potentially have indirect consequences for its business partners. Maintaining certifications and supply chain integrity is vital for companies operating in highly regulated industrial sectors.

If data is leaked, the company's compliance with EU recycling directives and its commercial reputation may be negatively impacted. Furthermore, if employee or customer information is involved, legal processes under GDPR may be triggered. The potential for regulatory scrutiny and the need for transparency with partners and customers are significant considerations in the wake of such claims.

Information about the thegentlemen group remains limited, making it difficult to attribute the attack or understand the group's specific motivations beyond the standard patterns of ransomware operations. For companies in the manufacturing sector, this highlights the importance of protecting not just intellectual property, but also the operational data that maintains the trust of a global supply chain.