Canal Capital Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 16, 2026, the ransomware group thegentlemen listed Canal Capital on its leak site, stating that internal files had been taken during an attack on the Bogotá-based media organization. The number of individuals whose information may be involved remains unknown, and no further details on the volume or contents of the material have been made public. For people whose data passes through Colombian media outlets that focus on local communities and social topics, the listing raises the possibility that documents not intended for wider circulation could now circulate elsewhere.

Inside the incident

The only confirmed information is the listing itself and the claim that internal files were exfiltrated. No date of the intrusion, no count of records, and no description of the access method have been released by Canal Capital or by investigators. The organization has not issued a public statement confirming or denying the incident, and no regulatory filing or law-enforcement notice has been referenced in available reports.

The group behind it: thegentlemen

Thegentlemen is a ransomware operator that maintains a public leak site where it lists organizations it claims to have targeted. Like other groups in this category, it typically combines encryption of systems with the removal of data, then uses the threat of publication to press for payment. The group has appeared in multiple prior listings involving both public and private entities; each new entry on its site represents an unverified assertion until corroborated by the victim or by independent investigation.

Canal Capital and its sector

Canal Capital operates as a media organization in Bogotá, Colombia, producing documentaries, series, and other programming on social issues, cultural topics, and community matters. Its audience includes residents of the capital and others interested in Colombian current affairs. Outlets of this kind routinely collect contact information from contributors, sources, and viewers, and they maintain internal records related to production, editorial planning, and organizational administration.

What was likely exposed

The listing refers only to “internal files.” No inventory of specific data categories has been published. Media organizations commonly hold employee records, contributor agreements, financial documents, and correspondence that can include personal identifiers. Whether any of these categories are present in the exfiltrated material is unconfirmed.

The real-world impact

Individuals named in internal files could face unsolicited contact or attempts to leverage the information for further scams. The organization itself may encounter operational disruption while restoring systems and may need to review its handling of source and contributor data. Because the scale of exposure is not yet known, the extent of these effects cannot be quantified at present.

What to do if you're exposed

Anyone who has interacted with Canal Capital as an employee, contributor, or viewer should monitor their email and financial accounts for unusual activity. Changing passwords for any associated services and enabling multi-factor authentication remain basic precautions. Readers can also run a free exposure scan of their email address against known breach data to check whether their information appears in publicly referenced incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.