Disney Family allegedly targeted by thegentlemen ransomware group

• Ransomware group: thegentlemen
• Country: United States
• Sector: Financial Services
• Announcement date: July 23, 2026

Thegentlemen group claims data leak of Disney Family

The ransomware group known as thegentlemen has claimed responsibility for a significant data breach targeting Disney Family, an entity associated with the domain shamrock.com. According to an announcement made on a leak site on July 23, 2026, the group alleges that they have successfully exfiltrated a massive amount of sensitive information belonging to the organization.

The group claims that the breach occurred around June 26, 2026. This alleged incident involves a substantial volume of data, with the group claiming that approximately 800 GB of information has been compromised. This large-scale data leak, if verified, represents a major security failure for the targeted organization, potentially exposing decades of historical and current records.

Details of the alleged data compromise

The claims made by thethegentlemen group suggest that the stolen dataset is not merely a collection of recent files, but a vast archive spanning from the 1980s through June 2026. The group alleges that the compromised information is highly sensitive and is organized across 14 different categories, covering critical areas such as family trusts, tax administration, and private equity fund management.

While the group has not provided any screenshots to verify the contents of the stolen data, they have listed several specific types of sensitive documentation that are reportedly included in the leak. The alleged contents include:

• Family trust documents
• Tax records
• Passports
• KYC documents
• Payroll records
• Bank reconciliations
• ERP credentials

The inclusion of such diverse data types, ranging from identity documents like passports to internal financial tools like ERP credentials, indicates a deep level of access into the organization's digital infrastructure. The presence of KYC (Know Your Customer) and bank reconciliation documents suggests that the breach reaches into the core of the firm's financial operations.

About Shamrock Holdings

Shamrock Holdings is a private investment firm and family office established by Roy E. Disney to manage the wealth of the Disney family. The company operates independently from The Walt Disney Company, focusing on private equity investments and family wealth management.

Potential impact and security implications

This alleged breach carries significant risks for the individuals whose data has been compromised. The exposure of passports, KYC documents, and tax records significantly increases the risk of identity theft and financial fraud for the affected parties. Furthermore, because the entity is based in the United States, the incident may lead to legal consequences under state-level data protection laws and financial regulations.

Given the firm's specific activities in private equity and trust management, the breach could potentially impact investor confidence and create vulnerabilities within the supply chain security. The nature of the data suggests that the attackers may be positioned to conduct double extortion—a tactic where attackers not only encrypt data but also threaten to leak it to pressure the victim—or launch highly targeted phishing campaigns using the stolen information.

In the broader context of cybersecurity, ransomware leak sites serve as a platform for extortion, where threat actors publicize stolen data to damage a company's reputation and increase leverage during negotiations. For organizations in the financial services sector, such incidents highlight the critical importance of robust data governance and strict access controls. Defensive strategies typically include implementing multi-factor authentication, maintaining rigorous encryption standards for sensitive documents, and conducting regular audits of ERP and financial systems to detect unauthorized access early.