ErgoMed Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 1, 2026, the ransomware group thegentlemen listed ErgoMed on its leak site, claiming to have exfiltrated internal files from the company during a ransomware operation. The number of individuals whose information may be involved remains unknown, and no further details about the volume or specific contents of the files have been made public. The incident raises immediate questions for current and former employees, job applicants, and client organizations whose records are handled by an occupational health provider. Internal files in this sector commonly contain employment screening results and related administrative records, so any confirmed exposure could affect privacy and employment-related decisions.

What happened

The listing appeared on July 1, 2026. The group stated that internal files had been taken during a ransomware attack on ErgoMed. No information has been released about the date of the intrusion itself, the method of access, the quantity of data, or whether any files were subsequently published.

Who is thegentlemen?

Thegentlemen is a ransomware group that maintains a leak site to list organizations it claims to have targeted. Such groups typically gain initial access through phishing, remote-desktop vulnerabilities, or compromised credentials, then exfiltrate data before deploying encryption. Public reporting on the group has documented similar listings against other organizations, though each claim requires independent verification.

About ErgoMed

ErgoMed is a U.S.-based occupational health and employment testing company that has operated loss-control programs since 1992. Its services include physical-demand simulation testing, musculoskeletal evaluations, and post-offer employment screening intended to help employers reduce workplace injuries. Organizations of this type routinely process records that link individuals to employment decisions and health-related assessments.

What was likely exposed

The only detail provided is that internal files were allegedly exfiltrated. The exact categories of information contained in those files have not been disclosed.

• Employment screening results and related test data
• Administrative and operational records held by the company
• Any additional documents stored on the affected systems

Why it matters

Internal files from an occupational health provider can include details that connect individuals to employment outcomes and medical evaluations. Unauthorized access to such material may lead to privacy intrusions or misuse in contexts such as hiring or insurance. For the organization, the incident adds operational disruption and potential regulatory scrutiny common to entities that handle employment and health information.

Were you affected?

Individuals can begin by monitoring official communications from ErgoMed and reviewing any notices sent to current or former employees and clients. Checking credit reports and account statements for unusual activity provides a basic first layer of review. Running a free exposure scan of an email address against known breach datasets can indicate whether the address has appeared in previously published data from other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.