DATAMATIC Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 6, 2026, the Italian company DATAMATIC appeared on a listing associated with the ransomware group thegentlemen. The listing states that internal files were exfiltrated during a ransomware attack. No figure has been published for the number of individuals whose information may be involved, and further technical details remain undisclosed at this time. The practical implication is that records held by a mid-sized distributor in the consumer electronics sector could contain contact details, transaction data or operational documents. Individuals or partner organisations connected to DATAMATIC therefore have an interest in understanding what was taken and whether their information appears in any subsequent disclosures.

Inside the incident

The only confirmed public information is the listing itself and the statement that internal files were removed. No date of intrusion, volume of data or method of initial access has been released by DATAMATIC or by investigators. The company has not issued a statement confirming or denying the claims.

Who is thegentlemen?

Thegentlemen is a ransomware group that maintains a leak site where it lists organisations it claims to have targeted. Such groups typically combine encryption of systems with the removal of files, then use the threat of publication to press for payment. The listing of DATAMATIC constitutes the group’s assertion of responsibility; independent confirmation of the underlying events has not been made public.

DATAMATIC and its sector

DATAMATIC S.p.A. is headquartered in Milan and operates as a distributor and sales organisation in the consumer electronics sector. Public records describe a workforce of 251–500 employees, with more than 200 staff focused on sales, logistics and partner support. The company reports estimated annual revenue between $50 million and $100 million and positions itself as a commercial intermediary between manufacturers and trade partners.

What data was at risk

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific record types, file counts or data categories has been published. Organisations of this kind routinely hold supplier contracts, customer order histories, logistics records and employee contact information, yet the precise contents of the exfiltrated material remain unconfirmed.

Why it matters

Even without a confirmed count of affected individuals, the exposure of internal files from a distributor can create downstream consequences for trading partners and end customers whose details appear in those records. For the company, the incident adds operational disruption and potential regulatory obligations under Italian and European data-protection rules. For individuals, the main concern is the possible misuse of any personal or commercial contact data that may have been among the files.

Were you affected?

Begin by monitoring official communications from DATAMATIC and any notices issued by Italian data-protection authorities. If you have had commercial dealings with the company, treat unsolicited messages that reference those dealings with caution. You can also run a free exposure scan of your email address against known breach data sets to check whether your information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.