Metro Mondego listed on thegentlemen leak site

• Ransomware group: thegentlemen
• Country: Portugal
• Sector: Transportation
• Announcement date: July 16, 2026

Metro Mondego listed on thegentlemen leak site

The Portugal-based transportation company Metro Mondego has been listed on the leak site of the threat actor group known as thegentlemen. The listing, which appeared on July 16, 2026, indicates a potential data breach involving the organization.

The claim by thegentlemen

The threat actor group known as thegentlemen announced Metro Mondego on their dedicated leak site. According to the announcement, the entity was discovered on July 16, 2026, and the post was made on that same date. While the group claims to have obtained the institution's data, it is important to note that no evidence or file list regarding the nature of the leaked information has been provided by the attackers.

In many modern cyberattacks, ransomware groups utilize leak sites to exert pressure on victims through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's systems but also claim to have exfiltrated sensitive data, threatening to publish it publicly unless a ransom is paid. This method aims to maximize leverage by threatening the victim's reputation and legal standing. However, in this specific instance, the group has not provided any screenshots or specific details to substantiate their claims regarding the stolen information.

Details regarding the alleged data breach

At this stage, there is no information regarding the content of the leaked data. The listing names no data types.

The lack of specific information makes it difficult to determine the exact scope of the incident. In such cases, it remains unclear whether there is a security vulnerability in the institution's systems or if the data has actually been exfiltrated. The absence of a file list or any visual proof means the actual impact on the organization's data integrity remains unverified by the source.

The organization profile

Metro Mondego is a public transport company responsible for sustainable mobility in the Coimbra, Miranda do Corvo, and Lousã regions of Portugal. The company operates a high-capacity transport system known as Metrobus, which consists of fully electric buses transitioned from a light rail project.

Implications and potential risks

This incident may indicate that the institution's operational data or employee information could be at risk. Because the institution operates in Portugal, a potential data breach may be subject to GDPR regulations and could lead to legal sanctions. Furthermore, the alleged leak may damage the institution's reputation and could create a basis for targeted phishing attacks against customers.

For organizations operating in the transportation sector, maintaining robust cybersecurity measures is critical to protecting both operational continuity and sensitive stakeholder information. Common defensive steps that organizations typically implement to mitigate such risks include:

• Implementing multi-factor authentication (MFA) across all remote access points and administrative accounts.
• Maintaining regular, offline, and tested backups to ensure resilience against encryption-based attacks.
• Conducting frequent vulnerability assessments and patch management to close security gaps.
• Providing continuous security awareness training to employees to prevent successful phishing attempts.
• Enforcing the principle of least privilege to limit the potential movement of an attacker within the network.

As public information about the group thegentlemen is limited, the full extent of the threat they pose and the actual impact on Metro Mondego remains to be seen.