Caja De Seguro Social Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Caja De Seguro Social was listed by thegentlemen ransomware group on April 14, 2026, after internal files were exfiltrated in a ransomware attack. Anyone connected to the organisation should check whether their information was exposed and take protective steps if needed.
On April 14, 2026, the ransomware group thegentlemen listed Caja De Seguro Social on its leak site, claiming to have exfiltrated internal files during a ransomware attack. The number of people affected remains unknown, and the organisation has not confirmed the incident or the extent of any data access.
The listing states that approximately 3TB of data was taken, described by the group as including pension, medical, and investment records. No further details on the method of intrusion, the timeline of events, or any ransom negotiations have been made public.
Inside the incident
The only confirmed public information is the leak-site posting itself. The group claims it obtained internal files from Caja De Seguro Social and offered to accept payment in exchange for deleting the data. No independent verification of the claim, the volume of data, or the specific contents has been released by the organisation or by investigators.
Key details such as the date of the intrusion, the initial access method, and whether any data was encrypted or further distributed remain undisclosed.
Who is thegentlemen?
Thegentlemen is a ransomware group known for targeting organisations and posting victim names on a dedicated leak site when ransom demands are not met. Like other groups in this category, it typically combines file encryption with data exfiltration to pressure targets.
Public reporting on the group has documented similar listings against entities in multiple countries, though each claim must be assessed individually because the accuracy of the posted information is not independently verified.
About Caja De Seguro Social
Caja De Seguro Social is Panama’s national social security institution. It administers pensions, healthcare services, and related benefits, operating a network of hospitals and clinics that serve the majority of the country’s population.
Entities of this type routinely process large volumes of personal and financial information tied to employment, medical treatment, and long-term benefit payments, making them high-value targets for data theft.
What was likely exposed
The listing describes internal files and states that roughly 3TB of data, said to include pension, medical, and investment records, were removed. The organisation has not published its own assessment of the incident, so the precise categories and volume of any exposed information are unconfirmed.
Why it matters
Records held by social security institutions often contain identifiers, employment histories, medical details, and banking information that can be used for identity fraud or targeted scams over long periods. When such data is claimed to have been taken, affected individuals face elevated risks of misuse even if the scale of the incident is not yet known.
For the institution, any confirmed exfiltration can affect public trust in systems that manage essential benefits and healthcare access for most citizens.
If your data was in this claimed breach
Monitor official statements from Caja De Seguro Social for any guidance it may issue. Individuals can also take the following steps:
- Review account statements and benefit records for unusual activity.
- Enable multi-factor authentication on any linked financial or government accounts.
- Request credit reports where available and place fraud alerts if suspicious patterns appear.
- Run a free exposure scan of your email address against known breach datasets to check for additional appearances of your information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
CSIR Structural Engineering Research Centre Listed by thegentlemen Ransomware GroupVirginia Historical Society Listed by thegentlemen Ransomware GroupRoyal Thai Navy Housing Cooperative Listed by thegentlemen Ransomware GroupThe City of Boyne City Listed by thegentlemen Ransomware GroupLatest breaches
Publicly posted by thegentlemen — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.