Caja De Seguro Social targeted by Thegentlemen ransomware group

• Ransomware group: Thegentlemen
• Country: Panama
• Sector: Government & Defense
• Announcement date: April 14, 2026

Thegentlemen claims to have compromised Caja De Seguro Social data

The threat actor known as Thegentlemen has listed a significant amount of data allegedly belonging to the Panamanian Social Security Fund, known as Caja De Seguro Social, on their dedicated leak site. This announcement, made on April 14, 2026, marks a major incident for the institution, with the group claiming that the breach occurred on the same day the announcement was posted.

According to the claims made by Thegentlemen, the group attempted to enter into negotiations with the management of the institution regarding a ransom payment. However, these negotiations were reportedly unsuccessful. Following the failure to reach an agreement, the group decided to publish the stolen information. The group has demanded a ransom of 2 BTC to prevent further exposure or as part of their extortion attempt.

Details of the alleged data leak

The threat actor claims that the volume of stolen information is approximately 3TB. While the group has provided no screenshots to verify the contents of the stolen files, they have described the data as being highly sensitive. The announcement alleges that the databases contain records that cover a significant portion of the Panamanian population.

The specific types of data allegedly involved in this breach include:

• Medical records
• Pension data
• Investment data

The scale of this alleged leak suggests a massive exfiltration of information that could impact a vast number of citizens within the country.

About Caja De Seguro Social

Caja de Seguro Social (CSS) is the public institution responsible for administering and governing the national social security and healthcare system in Panama. It manages a nationwide network of hospitals and clinics, providing healthcare and pension services to a large portion of the population.

Potential impact and security implications

This incident may create negative consequences for the functionality of Panama's public health and social security system. Given the sensitivity of the alleged data, individuals could face risks such as identity theft and fraud. The institution's role in serving a large portion of the population suggests that the impact of this breach may be extensive.

The act of offering the data for sale may indicate the use of double extortion tactics. In a double extortion scenario, ransomware actors do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data and threaten to leak it publicly unless a ransom is paid. This approach increases the pressure on the victim, as the threat of public exposure can cause significant reputational and legal damage, regardless of whether the organization can restore its systems from backups.

Public information about the group known as Thegentlemen is currently limited. However, the nature of this attack highlights the ongoing risks faced by government and defense sectors. Organizations operating in this sector, which manage critical public services, can take various defensive steps to mitigate such risks. These steps often include implementing robust multi-factor authentication, maintaining rigorous patch management schedules to close vulnerabilities, and conducting regular offline backups of critical databases. Furthermore, continuous monitoring of network traffic and implementing zero-trust architectures can help detect and contain unauthorized movements within a network before large-scale data exfiltration can occur.