Ekepis Listed by The Gentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On August 14, 2026, the ransomware group known as The Gentlemen listed Ekepis on its leak site. Public reporting so far consists of that listing and limited organisational background; the number of people who might be affected is unknown, and the listing does not disclose what data types, if any, were involved. Ekepis — formally associated with Greece’s former National Centre for the Accreditation of Continuing Vocational Training (EKEPIS) — no longer operates as a standalone body, and its functions were absorbed by EOPPEP. As of writing, Ekepis has not publicly confirmed the incident.

A leak-site listing is an extortion-related claim, not an independent verification. It may be incomplete, recycled, exaggerated, or false. What follows treats the group’s post as an allegation, explains what is and is not established by such a post, and outlines conditional steps people can take if they believe their information could have been held by the former organisation or its successors.

Inside the listing

According to the reported summary, The Gentlemen has named Ekepis on its leak site, with the matter recorded on August 14, 2026. The listing is associated in public notes with ekepis.gr and with profile material describing EKEPIS as Greece’s National Centre for the Accreditation of Continuing Vocational Training. Beyond the fact of the listing itself, public detail is limited: the count of people potentially affected is unknown, and data types named as exposed are not disclosed. Timing of any alleged intrusion, technical method, ransom demand, and whether any files were actually published are not established in the material provided.

The organisation described in background notes no longer exists in its earlier form. Accreditation and certification duties were absorbed by EOPPEP (the National Organisation for the Certification of Qualifications and Vocational Guidance). Anyone seeking related services is directed to EOPPEP or official Greek government channels rather than the old ekepis.gr domain. That institutional change does not, by itself, confirm or disprove a ransomware crew’s claim about historical systems or archives; it only means the public face of the work has moved.

A leak-site entry establishes that a group chose to name an organisation for pressure or publicity. It does not establish that a breach occurred, that data left the organisation, or that any particular records are in criminal hands. Until a company, a regulator, or another independent source confirms an incident, the responsible framing remains: The Gentlemen claims Ekepis is a victim; confirmation from the organisation side has not been reported here.

Who is The Gentlemen?

The Gentlemen is a ransomware and extortion actor known in public reporting for double-extortion style operations: encrypting systems where they can, and threatening to publish or sell stolen data on a dedicated leak site if demands are not met. Like other groups in this category, they rely on naming victims, posting sample claims, and setting deadlines to increase pressure. Their listings are marketing and coercion tools as much as technical disclosures.

Well-documented patterns for such groups include opportunistic initial access, lateral movement inside networks, and staged claims about the sensitivity of stolen files. None of that general pattern should be read as a verified account of what happened at Ekepis. For this matter, the only incident-specific assertion in the facts is that the group listed the name; the group’s broader reputation does not turn an unverified listing into a claimed breach.

About Ekepis

EKEPIS was Greece’s National Centre for the Accreditation of Continuing Vocational Training. Its role involved certifying adult educators and lifelong learning providers — work that sits at the intersection of education quality assurance, professional credentials, and public administration. Those responsibilities were later absorbed by EOPPEP, which handles certification of qualifications and vocational guidance at national level. The old organisational brand and domain are therefore historical rather than current service channels.

Bodies that accredit trainers and training providers typically sit on records tied to institutions, instructors, programme approvals, and administrative correspondence. A claim against such a name matters because credentialing systems touch people’s professional standing and, in some cases, long-lived identity and contact data. It also matters because successor agencies and archived systems can still hold older files even after a reorganisation. That is context about the sector, not proof that any specific archive was accessed.

What was likely exposed

The facts state that data types named as exposed are not disclosed, and the number of people affected is unknown. It is therefore not possible to state what, if anything, left any system. The Gentlemen’s listing does not supply a verified inventory.

If files connected to a national vocational-accreditation body were ever taken, organisations in this sector typically hold materials such as organisational contact details, accreditation or certification case files, records about training providers and adult educators, correspondence, and internal administrative documents. Some of that can include names, professional identifiers, addresses, and other personal data used in licensing or quality processes. Those are sector norms, not a confirmed description of this claim. Exact contents remain unconfirmed, and readers should not assume their records are included.

What's at stake

For individuals, the practical risk is conditional. If personal or professional data from accreditation processes were copied, possible harms include targeted phishing that references real training or certification history, identity misuse, or pressure scams that cite official-sounding Greek education bodies. Credential-related data can be especially persuasive in social engineering because it sounds institutional and specific. None of that is established as having occurred here; it is the type of risk people weigh when a public-sector-adjacent name appears on a leak site.

For the organisational side — including successor entities that inherited functions — stakes include reputational harm from an unverified allegation, potential regulatory attention if a breach were later confirmed, and the operational cost of investigating historical systems. A listing alone does not prove negligence or describe security controls; it only shows that a criminal group chose to publish a name. Treating the claim as unconfirmed avoids turning an extortion post into an unearned verdict on the institution.

Steps worth taking either way

If you ever dealt with EKEPIS, ekepis.gr, or related Greek vocational-accreditation processes, treat the situation as a precaution opportunity rather than proof your data is public. Prefer official EOPPEP or government portals for any legitimate contact. Be wary of unexpected messages that cite accreditation files, unpaid “ransoms,” or urgent certificate problems — especially if they push you to click links, open attachments, or pay fees. Use unique passwords on email and government-service accounts, and enable multi-factor authentication where available. If you still hold old certificates or correspondence, store them securely and do not send copies in response to cold outreach.

Monitor bank and identity activity only to the extent you normally would after any uncertain data scare, and report clear fraud attempts to the appropriate Greek authorities. You can also run a free exposure scan of your email to check whether your address has already appeared in known breach datasets unrelated to this claim. That check does not confirm or deny The Gentlemen’s listing; it only helps you see whether your email is already circulating in compiled leak material from other incidents. Stay with verified public sources for updates, and remember: as of writing, the company side has not publicly confirmed this incident, and the listing remains an unverified claim by The Gentlemen.

AICompiled with AI assistance from public sources and published under our editorial standards.