Excellentiam Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 18, 2026, the ransomware group thegentlemen listed Excellentiam on its leak site and claimed to have exfiltrated internal files during a ransomware attack. The number of people affected remains unknown, and no further details on the volume or contents of the material have been made public. The incident is one more instance of a ransomware operator publishing a corporate victim after an intrusion that combined encryption with data removal. Public reporting at this stage is limited to the group’s listing and the description of the material as internal files.

Inside the incident

The only confirmed timing is the March 18, 2026 listing. No information has been released on when the intrusion began, how long the attackers were inside the network, or the precise method of initial access. The scale of the operation, including the quantity of files removed and whether any systems were encrypted, is undisclosed.

Who is thegentlemen?

Thegentlemen is a ransomware group that maintains a public leak site where it lists organizations it claims to have compromised. Like other groups in this category, it typically combines ransomware deployment with the removal of data, then uses the threat of publication to pressure victims. Its listings are presented by the group as evidence of successful operations, though independent confirmation of each claim is not always available.

About Excellentiam

Excellentiam provides business-process outsourcing, know-your-customer verification, and IT support services. Its offerings include management of client identity forms with validation and electronic signatures, a national IT service desk, document-management solutions, and operational outsourcing. Organizations in this sector routinely process records that support regulatory compliance and client operations for other companies.

The information in question

The listing states that internal files were removed. No inventory of specific data types or record counts has been published. Organizations that perform KYC and document-management work commonly hold client identification details, corporate records, and operational correspondence, but the exact contents of the material allegedly taken from Excellentiam have not been confirmed.

The real-world impact

Individuals whose records appear in the exfiltrated files face the possibility that their personal or identity information could be used for fraud or sold. For the organization and its clients, exposure of internal operational files can complicate regulatory compliance and business relationships. Because the number of affected records is unknown, the full extent of these risks cannot yet be measured.

What to do if you're exposed

Review any recent communications from Excellentiam or organizations that use its services. Enable multi-factor authentication on accounts that may be linked to the affected systems and monitor statements and credit reports for unusual activity. Readers can also run a free exposure scan of their email address against known breach data to determine whether their information has appeared in previously published sets.

AICompiled with AI assistance from public sources and published under our editorial standards.