Lawson Software listed on thegentlemen ransomware leak site

• Ransomware group: thegentlemen
• Country: Thailand
• Sector: Professional Services
• Announcement date: April 26, 2026

Thegentlemen claims data breach at Lawson Software

The ransomware group known as thegentlemen has listed the Thailand-based IT consulting firm Lawson Software on its dedicated leak site. According to an announcement published by the group on April 26, 2026, the threat actors claim to have successfully obtained data belonging to the organization.

The group's announcement marks a new entry on their platform, though details regarding the specific nature of the attack remain scarce. Publicly available information concerning the operations and identity of the thegentlemen group is currently limited, making it difficult to establish a broader pattern of their activities or specific technical methodologies.

Details of the alleged leak

On the date of the announcement, the group asserted that they had gained access to the organization's information. However, the listing provided by the threat actors lacks specific technical details or evidence to substantiate the claim. At this time, there are no screenshots or data samples provided on the leak site to verify the breach.

Because of the absence of these evidentiary materials, the specific nature and content of the alleged leaked data remain unknown. Furthermore, the listing does not provide any information regarding the total size of the data, the specific file count, or a specific ransom demand.

About Lawson Software

Lawson Software (Thailand) Co., Ltd. is a professional services firm based in Bangkok, Thailand. Founded in 1999, the company has established itself as a specialist in the IT consulting sector. The organization focuses on providing business software solutions, with a particular emphasis on the implementation of Enterprise Resource Planning (ERP) systems for its clients.

Potential impact and implications

This incident may lead to significant disruptions in the operational processes of Lawson Software. Beyond immediate technical disruptions, the claim poses a potential threat to the organization's reputation. If customer or employee data has been compromised, there is an increased risk of identity theft or the execution of targeted phishing attacks against the affected individuals.

Regulatory and tactical considerations

Under the Personal Data Protection Act (PDPA) in Thailand, the organization may be required to fulfill specific data breach notification obligations to regulatory bodies and affected parties. Compliance with these legal frameworks is a critical component of managing the aftermath of a potential data exposure.

The situation also highlights the common use of double-extortion tactics by modern ransomware groups. In these scenarios, attackers do not merely encrypt systems but also steal sensitive data, using the threat of public disclosure as leverage to demand a ransom. It is possible that the organization may be facing such a demand to prevent the publication of its data.

In general, organizations in the professional services and IT consulting sectors can mitigate such risks by implementing robust data protection strategies. This includes maintaining regular offline backups, enforcing strict access controls, and conducting regular security awareness training to defend against the phishing attempts that often follow a breach. Continuous monitoring of network traffic and implementing multi-factor authentication are also standard defensive measures to reduce the likelihood of unauthorized data exfiltration.