MBM listed on thegentlemen ransomware leak site

• Ransomware group: thegentlemen
• Country: Poland
• Sector: Education
• Announcement date: January 24, 2026

Thegentlemen claims attack on MBM

The threat actor group known as thegentlemen has published an announcement on their leak site involving the Polish organization MBM. According to the post published on January 24, 2026, the group claims that MBM was subjected to a cyberattack on January 11, 2026. While the group alleges that they have successfully obtained data belonging to the institution, the announcement does not include specific details or evidence to substantiate the claim.

Ransomware groups often utilize leak sites to exert pressure on victims through a tactic known as double extortion. In such scenarios, attackers not only encrypt an organization's systems but also steal sensitive information, threatening to publish it publicly if a ransom is not paid. This method aims to maximize the impact of the attack by leveraging the threat of reputational damage and regulatory scrutiny.

The listing currently serves as a claim by the threat actor. At this stage, the announcement provides no confirmation regarding the actual success of the breach or the specific nature of the intrusion. The group's presence on leak sites is a common method for demanding payment, often targeting organizations that prioritize data integrity and privacy.

Details regarding the alleged data breach

Despite the claims made by thegentlemen, there is a significant lack of information regarding the actual content of the leaked data. The group has not provided any data samples, file counts, or specific details about the information they claim to have stolen. The screenshot provided alongside the announcement only displays the general interface of the group's leak site, rather than any sensitive documentation or evidence of exfiltrated files.

The listing names no specific data types that have been compromised. Because no information or samples have been provided, it remains impossible to determine the scope of the alleged theft. In many ransomware incidents, the absence of immediate data samples can be due to various factors, ranging from the attackers preparing a larger leak to the organization's ability to contain the breach before significant data exfiltration occurs.

About MBM

MBM is a Polish-based training and consulting company that specializes in providing professional training, compliance support, and the implementation of legal procedures. Their services are directed toward both public institutions and private organizations. The firm focuses on critical areas such as data protection, GDPR compliance, and workplace obligations, offering specialized audit services and documentation support to ensure their clients meet regulatory standards.

Potential implications and industry risks

Public information regarding the thegentlemen group remains limited, making it difficult to assess their typical patterns or capabilities. However, the nature of MBM's business presents unique risks. Because MBM operates specifically in the field of data protection and compliance, the verification of this leak claim could indicate that sensitive information belonging to its diverse client base may be at risk.

Since the institution operates within Poland, any confirmed data breach could lead to significant legal sanctions and administrative fines under the EU General Data Protection Regulation (GDPR). Beyond the direct legal consequences for MBM, such an incident could pose substantial supply chain risks for the various organizations that rely on the firm for consulting services. A compromise of a compliance provider can lead to a domino effect, increasing the likelihood of clients being exposed to identity theft or targeted phishing attacks.

To mitigate such risks, organizations in the consulting and compliance sector often implement defensive measures such as robust access controls, continuous monitoring of data exfiltration, and comprehensive employee training. Maintaining strict adherence to data protection frameworks and ensuring strong encryption for sensitive client documentation are also vital components of a resilient security posture. Organizations should remain vigilant against secondary attacks, such as phishing, which frequently follow the exposure of corporate data.