El IBR listed on thegentlemen ransomware leak site

• Ransomware group: thegentlemen
• Country: Spain
• Sector: Agriculture and Food Production
• Announcement date: February 24, 2026

The threat actor known as thegentlemen has published a post on their leak site claiming to have compromised data belonging to El IBR. This announcement, which appeared on February 24, 2026, marks a new potential data breach incident involving the institution.

The claimed attack and event details

According to the announcement made by the thegentlemen group, the organization El IBR was listed on their leak site on February 24, 2026. The group claims to have successfully gained access to the institution's data. However, the specifics of the intrusion remain unclear due to technical issues encountered on the attacker's platform.

The screenshot provided by the group displays a technical verification error on the leak site. Because of this error, no detailed information regarding the content or the specific nature of the leaked data is currently available. In many ransomware scenarios, threat actors use leak sites to pressure victims through double extortion, a tactic where sensitive data is stolen and then threatened to be released publicly if a ransom is not paid. While the group has made this claim, the technical error prevents a clear understanding of what has been taken.

Information regarding the leaked data

At this stage, there is no information regarding the nature or the scope of the leaked data. The listing does not provide details on the file count, the total size of the data, or the specific types of files involved. The screenshot associated with the claim merely displays a verification error on the group's leak site, leaving the actual contents of the alleged breach unknown.

Implications and risk assessment

This incident indicates that the institution's sensitive research and biotechnology data may be at risk. Given the nature of the organization, the potential exposure of such data carries significant weight. Until the content of the leaked data is clarified, there is a heightened risk that phishing attacks targeting the institution's employees or researchers could be conducted by the threat actors or their affiliates.

The security implications extend beyond the immediate organization. Considering the institution's academic and commercial collaborations, it is assessed that the leak could pose secondary risks to the supply chain. When research institutions are compromised, the interconnected nature of modern science means that partners and collaborators may also face increased exposure.

Furthermore, if the institution operates in Spain, data breach notification obligations under GDPR may arise. Organizations facing such threats typically focus on strengthening their defensive posture through several common industry practices. These include implementing multi-factor authentication, maintaining robust backup strategies, and conducting regular employee training to recognize phishing attempts. Because information about the thegentlemen group is limited in the public domain, organizations must remain vigilant against their evolving tactics.

Summary of the threat landscape

• Threat actor: thegentlemen
• Target: El IBR
• Claimed date: February 24, 2026
• Status: Data breach claimed; technical verification error on leak site