Amicell Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by pairing encryption with data theft and public leak-site listings, a pattern that has become a routine feature of the current threat landscape. When a company’s name appears on such a site, the claim alone can raise immediate questions for employees, partners and customers even before independent confirmation is available.

On 31 July 2026, the ransomware group known as thegentlemen listed Amicell, an Israeli manufacturer of custom battery systems. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown and further technical detail has not been disclosed. The listing is a claim by the group and should be treated as unverified unless corroborated by the organisation or independent investigators.

What happened

According to available public information, Amicell was named on thegentlemen’s leak site on or around 31 July 2026. The reported summary indicates that internal files were exfiltrated as part of a ransomware attack. No confirmed figure for the number of individuals affected has been released, and details such as the precise date of initial access, the intrusion method, the volume of data taken, or whether systems were encrypted have not been made public. At this stage the incident is known primarily through the group’s listing and secondary reporting that characterises the event as a ransomware attack involving exfiltration of internal files.

The group behind it: thegentlemen

thegentlemen is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, operators typically steal data before deploying encryption and then threaten to publish the stolen material if a ransom is not paid. Groups of this type maintain dedicated leak sites where they post victim names, sometimes accompanied by sample files or countdowns, in order to increase pressure. Public reporting on thegentlemen has described activity consistent with this pattern across multiple sectors, though specific claims made about any single victim—including Amicell—remain assertions by the group until independently verified. No statements attributed to thegentlemen beyond the listing of Amicell itself are included in the facts available for this incident.

Amicell and its sector

Amicell, also identified as Amit Industries Ltd., is an Israeli manufacturer founded in 1989 and headquartered in Ashdod. The company specialises in custom-designed battery packs, chargers and Battery Management Systems for demanding applications in defence, medical devices, unmanned aerial vehicles, robotics and industrial settings. Organisations operating in these supply chains routinely handle technical designs, quality and test records, supplier and customer correspondence, and internal operational documents. A breach affecting a firm in this position can therefore carry implications beyond the company itself, because its products and documentation often sit inside larger defence, medical or industrial programmes where continuity and confidentiality matter.

The information in question

Public reporting names the exposed material only as “internal files exfiltrated in a ransomware attack.” No inventory of specific data categories—such as employee records, customer lists, engineering drawings or financial documents—has been confirmed in the available facts. Companies of Amicell’s type typically maintain design files, bills of materials, test data, contracts, and ordinary business records that may include personal data of staff or contacts. Because the exact contents remain undisclosed, it is not possible to state with certainty what was taken; the only confirmed characterisation is that internal files were claimed to have been removed during the attack.

The real-world impact

For individuals whose information may have been among the internal files, risks include potential misuse of contact details, credentials or other personal data if those elements were present, as well as targeted phishing that references the incident. For Amicell, the consequences can include operational disruption, the cost of investigation and recovery, contractual notification obligations, and reputational pressure arising from the public listing itself. Partners and customers in defence, medical and industrial programmes may also need to assess whether any shared technical or commercial information was exposed. Until the organisation or independent analysts provide a clearer accounting, the scale of these effects remains unconfirmed.

What to do if you're exposed

If you have a relationship with Amicell as an employee, contractor or partner, monitor official communications from the company for guidance. Treat unsolicited messages that reference the breach with caution, and avoid clicking links or opening attachments from unfamiliar sources. Consider changing passwords on accounts that may have been used in connection with the organisation, and enable multi-factor authentication where it is available. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets, which can help you prioritise further protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.