Focus Design Partners Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware operations that combine encryption with data theft remain a persistent feature of the threat landscape, with groups frequently using public listings to apply pressure on targeted organizations. On May 12, 2026, Focus Design Partners was listed by thegentlemen ransomware group. The listing states that internal files were exfiltrated during a ransomware attack, though the number of people affected and the precise volume of data remain unknown.

Inside the incident

The incident came to light through a listing on the threat actor’s site on the reported date of May 12, 2026. The group claims to have carried out a ransomware attack against Focus Design Partners and to have removed internal files. No further details on the timing of the intrusion, the method of initial access, the scale of encryption, or any ransom demand have been disclosed in available reporting.

Who is thegentlemen?

Thegentlemen is a ransomware group that maintains a leak site where it lists organizations it claims to have compromised. Such groups typically rely on data exfiltration alongside encryption to create leverage. Public records of the actor’s prior activity show a pattern of targeting mid-sized and larger entities across multiple countries, though specific claims made about Focus Design Partners rest solely on the group’s own listing and have not been independently verified beyond that assertion.

Focus Design Partners and its sector

Focus Design Partners operates as an international architecture, engineering, and project management firm with nearly five decades of activity and offices in at least six countries. The organization works on large-scale projects in sports, healthcare, commercial, and infrastructure sectors. Firms of this type routinely store design documents, client correspondence, engineering specifications, and contractual records that can contain both proprietary information and personal data relating to employees, partners, and project stakeholders.

What was likely exposed

The only data category named in connection with the incident is internal files exfiltrated during the ransomware attack. The exact contents of those files have not been disclosed. Organizations in the architecture and engineering sector commonly hold records that include employee information, client details, project specifications, and financial documentation, but whether any of these categories were present in the exfiltrated material remains unconfirmed.

What's at stake

Exposure of internal files can create operational and reputational consequences for the affected organization and can lead to follow-on risks for individuals whose information appears in those files. Where personal data is involved, affected people may face increased chances of targeted phishing or identity-related misuse. The organization itself may encounter regulatory scrutiny and costs associated with investigation and remediation, though the extent of these outcomes depends on details that have not yet been made public.

What to do if you're exposed

Individuals who believe their information may have been involved should begin with basic verification and protective steps.

• Run a free exposure scan of your email address against known breach data to check for appearance in this or other incidents.
• Monitor bank and credit accounts for unusual activity and consider placing fraud alerts with major credit bureaus.
• Change passwords for any accounts linked to the organization and enable multi-factor authentication where available.
• Remain alert for unsolicited messages that reference the company or recent projects.

AICompiled with AI assistance from public sources and published under our editorial standards.