All Rush Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In recent years ransomware groups have continued to target mid-sized service businesses that maintain client records and operational systems, often publishing claims of access on dedicated leak sites. On December 24, 2025, the Calgary print company All Rush appeared on a listing attributed to the ransomware group thegentlemen, with the only confirmed detail being the exfiltration of internal files. The incident is one of many similar claims made against organizations in the commercial printing and promotional-products sector, where data handling supports marketing and branding work for clients of varying sizes.

What happened

The listing was reported on December 24, 2025. Thegentlemen ransomware group placed All Rush on its site, stating that internal files had been exfiltrated during a ransomware attack. No information has been released on the number of individuals affected, the volume of data involved, the date of the intrusion, or the specific techniques used to gain access. Public detail on confirmation of the data’s release or any ransom demands remains limited to the group’s listing.

Who is thegentlemen?

Thegentlemen is a ransomware operation that maintains a leak site where it lists organizations it claims to have compromised. Such groups typically encrypt systems and threaten to publish stolen material if demands are not met. The listing of All Rush constitutes the group’s claim of involvement; independent verification of the underlying access or data has not been publicly established.

About All Rush

All Rush operates as a full-service print shop in Calgary. It produces print materials, custom apparel, signage in small and large formats, and promotional products for clients ranging from individuals to larger organizations. Services include corporate wear, event tickets, mailing capabilities, and branding support, with more than twenty years of operation in the sector. Companies of this type routinely process order details, artwork files, client contact information, and production records as part of their daily work.

What was likely exposed

The only data type named in connection with the incident is internal files exfiltrated during the ransomware attack. Organizations in commercial printing commonly retain customer order histories, artwork submissions, billing records, and internal operational documents. The precise contents of the files referenced in the listing have not been disclosed, so the exact categories of information involved remain unconfirmed.

What's at stake

Exposure of internal files can create operational disruption for the affected business and potential follow-on contact from parties seeking to misuse any client-related details that were present. For individuals or organizations that have placed orders with All Rush, the main concerns center on the possible appearance of contact information or project files in future unauthorized disclosures. The organization itself faces costs associated with investigation, system restoration, and any required notifications.

If your data was in this claimed breach

Monitor bank and credit accounts for unusual activity and consider placing fraud alerts with major credit bureaus. Review any recent communications from All Rush for guidance on the incident. Individuals can run a free exposure scan of their email address against known breach data to determine whether their information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.