Delta Ducon Engenharia Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 23, 2026, the ransomware group thegentlemen listed Delta Ducon Engenharia on its leak site, stating that internal files had been exfiltrated during an attack on the Brazilian engineering firm. The number of individuals whose information may be involved is not known, and no further details about the scale or contents of the material have been made public. This development matters because Delta Ducon works with industrial clients across metallurgy, chemicals, pharmaceuticals, food production and construction. Any records that contain contact details, project specifications or operational data could affect business partners and employees even if the precise exposure remains unconfirmed.

What happened

The incident came to light when thegentlemen added Delta Ducon Engenharia to its data-leak site on March 23, 2026. The group claims to have taken internal files in a ransomware operation. No information has been released about the date of the intrusion itself, the volume of data involved, or whether any material was later published. Public records do not show confirmation of the claim from the company or from independent investigators.

The group behind it: thegentlemen

Thegentlemen is a ransomware actor that maintains a leak site to pressure victims into paying. Groups of this type typically gain initial access through phishing, stolen credentials or unpatched remote-access tools, then move laterally inside networks to locate and copy files before deploying encryption. They have been observed listing organisations from multiple countries and sectors. In this case the listing itself constitutes the group’s claim; no independent verification of the exfiltration has been reported.

Who is Delta Ducon Engenharia?

Delta Ducon Engenharia is a Brazilian company with more than twenty-five years of activity in environmental systems. It designs and supplies equipment for air-emission control, dust removal, gas treatment, water treatment and pneumatic transport. Its clients operate in metallurgy, chemicals, pharmaceuticals, food processing and construction. The firm therefore routinely handles technical specifications, client contracts, supplier information and internal engineering documentation.

What was likely exposed

The only detail released is that internal files were allegedly exfiltrated. The exact categories of data have not been disclosed. Organisations in this sector commonly store employee records, client contact lists, project drawings, equipment specifications and regulatory compliance documents. Without a published inventory it is not possible to state which of these categories, if any, were taken.

What's at stake

Exposed internal files could reveal operational details that competitors or regulators might use, or they could contain personal information about staff and clients. Individuals whose data appear in such records may face increased risk of targeted phishing or identity misuse. For the company the incident adds pressure on incident response, regulatory notifications and relationships with industrial customers who expect confidentiality around process designs.

If your data was in this claimed breach

Monitor email accounts associated with Delta Ducon for unusual messages and enable multi-factor authentication on any linked services. Review bank and credit statements for unauthorised activity. Readers can run a free exposure scan of their email address against known breach data to check whether their information has appeared in previously published sets.

AICompiled with AI assistance from public sources and published under our editorial standards.