eDevice Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 09, 2026, the ransomware group thegentlemen listed eDevice on its leak site, stating that internal files had been taken during a ransomware attack. The number of people affected remains unknown, and no further details on the volume or contents of the material have been made public. Because eDevice supplies connected-care platforms used by hospitals and device manufacturers to monitor patients remotely, any confirmed exposure of internal records could involve information tied to the delivery of medical services.

The practical stakes center on the fact that the organization handles data linked to patient connectivity across more than 650,000 individuals worldwide. Even without confirmed patient records, the loss of internal files from a healthcare technology provider can create downstream risks for clinical operations and the organizations that rely on its systems.

Breaking down the breach

The only confirmed information is the listing itself and the statement that internal files were allegedly exfiltrated. No date of the intrusion, no count of records, and no description of the encryption or exfiltration method have been disclosed. The scale of the operation and whether any data were subsequently published remain unconfirmed.

Inside thegentlemen

Thegentlemen is a ransomware group that maintains a leak site where it lists organizations it claims to have targeted. In this case the group claims responsibility for the eDevice incident through that listing. Public reporting on the actor has documented its use of ransomware to encrypt systems and its practice of publishing stolen material when ransom demands are not met, though specific tactics or prior incidents tied to this victim have not been independently verified beyond the listing.

eDevice and its sector

eDevice develops connected-care platform solutions that link medical devices to remote monitoring services. The company has operated in the healthcare technology sector for more than fifteen years and serves as a connectivity partner to manufacturers including Medtronic, Honeywell, and Philips. Its platforms support virtual and remote care programs used by hospitals and device makers. A breach at such a provider can affect the data flows that underpin ongoing patient monitoring rather than a single hospital’s records.

What was likely exposed

The only data type named in the listing is internal files exfiltrated during the ransomware attack. No further categories—such as patient identifiers, clinical records, or device telemetry—have been confirmed. Organizations of this type routinely hold configuration data, partner communications, and system logs; however, the exact contents of the exfiltrated material remain unconfirmed.

Why it matters

Internal files from a connectivity provider can contain operational details that reveal how remote-monitoring systems are configured and which facilities rely on them. Disclosure of such material could assist further targeting of healthcare networks or create compliance obligations for the organizations that use eDevice’s platforms. For individuals, the risk depends on whether any patient-linked information was among the files—an issue that has not been clarified.

If your data was in this claimed breach

Monitor accounts associated with any healthcare providers or device manufacturers you use, and watch for unusual activity. Enable multi-factor authentication on patient portals and connected-device accounts. You can run a free exposure scan of your email address against known breach data to check whether your information appears in publicly reported incidents. Organizations that suspect their data may have been involved should contact eDevice directly for any notifications they issue.

AICompiled with AI assistance from public sources and published under our editorial standards.