Colliers listed on The Gentlemen ransomware leak site

• Ransomware group: The Gentlemen
• Country: Canada
• Sector: Professional Services
• Announcement date: November 21, 2025

The Gentlemen claims a breach against Colliers

The threat actor known as The Gentlemen has officially listed the multinational corporation Colliers on their dedicated leak site. Through a recent announcement, the group has alleged that they successfully conducted a cyberattack against the commercial real estate services operations of the organization. This announcement marks a significant development in the ongoing threat landscape facing large-scale professional service providers.

The Gentlemen group has communicated this targeting through a post on their leak site, claiming that the company's operations have been compromised. At this stage, information regarding this specific threat actor remains limited within the public domain, making it difficult to ascertain their full capabilities or typical operational patterns. Ransomware groups often use these leak sites to exert pressure on victims, a tactic frequently associated with double extortion strategies where data is both encrypted and stolen to increase leverage during negotiations.

Details regarding the alleged data breach

Despite the announcement made by The Gentlemen, there is currently a lack of concrete information regarding the specific nature of the incident. The threat actor has not provided any details or sample files regarding the alleged leaked data. Furthermore, there is no information available regarding the total size of the data or the specific file count involved in the purported breach.

The listing names no specific data types or categories that have been compromised. Additionally, no ransom demand has been issued or made public by the group in relation to this specific claim. Observations of the group's leak site have noted that a screenshot displays a verification error encountered while attempting to access the site, which may complicate the verification of the claim.

Common ransomware tactics

In many modern cyberattacks, threat actors employ various methods to maximize their impact. While the specifics of this case remain unconfirmed, ransomware groups often follow a pattern of gaining initial access, moving laterally through a network, and eventually exfiltrating sensitive information before deploying encryption. The use of a leak site serves as a public stage to claim responsibility and demand payment, often threatening to release sensitive corporate or client information if the demands are not met.

About Colliers

Colliers International Group Inc. is a multinational company providing commercial real estate services to corporations, investors, and governments worldwide. The company offers a wide range of professional services, including real estate brokerage, property management, valuation, and strategic consulting.

Potential risks and organizational implications

This incident may pose a potential risk to Colliers' operational processes and corporate data. Given the company's extensive client portfolio, a confirmed breach could lead to third-party risks and the exposure of trade secrets. Because the company is based in Canada, any potential data breaches may be subject to PIPEDA regulations, which could trigger legal proceedings.

The lack of concrete evidence regarding ransom demands or data samples from the threat actor suggests that the situation may still be in its early stages or that a negotiation process could be underway. In such scenarios, the absence of immediate data publication does not necessarily mean a breach has not occurred, but rather that the threat actor has not yet moved to the public disclosure phase of their extortion attempt.

For organizations operating within the professional services sector, maintaining robust defensive postures is critical. Common defensive steps include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee security awareness training. Furthermore, organizations often focus on network segmentation to prevent lateral movement and maintain comprehensive logging and monitoring to detect unauthorized access early in the attack lifecycle. As the situation regarding Colliers evolves, the industry continues to monitor such claims to better understand the evolving tactics of groups like The Gentlemen.