FTAPI Software Listed by The Gentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 25, 2026, the ransomware group known as The Gentlemen listed FTAPI Software on its leak site. That listing is an unverified claim by the group. As of writing, FTAPI Software has not publicly confirmed that an incident occurred, and independent confirmation from regulators or established breach indexes is not reflected in the available record. Public detail on timing, method, scale, and any data involved remains limited.

FTAPI provides tools for exchanging sensitive business information. A leak-site claim against a firm in that role matters because customers and partners may want to understand what is actually known, what is only alleged, and what practical steps make sense if their information were ever involved. Nothing in the public listing alone establishes that files left the company or that any particular person was affected.

What is being claimed

The Gentlemen have listed FTAPI Software on their leak site, according to reporting dated September 25, 2026. The available facts do not describe how the group says it obtained access, whether a ransom demand was made, what volume of material is allegedly held, or when any intrusion is said to have taken place. The number of people potentially affected is unknown. Data types named as exposed are not disclosed in the record provided.

A leak-site listing is a form of pressure commonly used by extortion crews. It signals that the group wants attention and leverage; it does not, by itself, prove that a breach succeeded, that sample files are authentic, or that a full dataset will be published. Readers should treat the listing as an accusation until the company, a regulator, or other authoritative sources confirm or deny it.

Who is The Gentlemen?

The Gentlemen are known publicly as a ransomware and extortion actor. Groups in this category typically encrypt systems or claim to have copied data, then threaten publication on a dedicated leak site if payment is not made. Public reporting on such actors often describes double-extortion patterns: disruption inside the victim environment paired with the threat of leaking stolen files. Tactics, tooling, and victim selection can vary over time and are not fixed for every listing.

For this specific case, the only incident-related assertion in the facts is that the group listed FTAPI Software. No further claims by The Gentlemen about this victim—such as file counts, screenshots, or technical narratives—are included in the material supplied for this article. Any broader reputation the group has from other reported activity should not be read as proof of what happened at FTAPI.

Who is FTAPI Software?

FTAPI Software is a Munich-based software company founded in 2010. It offers a platform aimed at secure, GDPR-oriented exchange of sensitive business data and related workflow automation, including encrypted email and file transfer, virtual data rooms, digital forms, and no-code process automation. Public descriptions state that it serves more than 2,000 organizations and over a million users, with a concentration in public administration, healthcare, insurance, and industry, and that data is hosted in Germany under certifications such as ISO 27001, BSI C5, and SOC 2, with optional zero-knowledge encryption among its offerings.

Organizations that build products for moving regulated or confidential business content sit in a consequential spot in the supply chain. Customers often rely on them precisely because the workloads involve contracts, personal data, health-related information, or other material that must stay controlled. A public extortion listing against such a vendor can raise questions for clients even when the underlying claim is unconfirmed, because the hypothetical blast radius includes not only the vendor’s own staff records but also data customers may have entrusted to the service. That consequence flows from the sector’s role, not from any verified finding about this listing.

What data was at risk

The facts state that data types named as exposed are not disclosed. It is therefore not possible to say what, if anything, was taken. Asserting a specific inventory would go beyond the record and would treat attacker marketing as an audit.

If files were taken from a company in this sector, firms of this kind typically hold combinations of business contact data, account and tenancy metadata, support correspondence, configuration details, and—depending on how customers use the product—documents and form submissions that may include personal or commercially sensitive content. Whether any of that was involved here is unconfirmed. People affected are listed as unknown.

The real-world impact

Until there is confirmation, the concrete impact on individuals and on FTAPI remains speculative. Leak-site listings can still create operational and reputational strain: customers may open tickets, security teams may review logs and vendor risk questionnaires, and staff may face phishing that pretends to reference the alleged incident. Extortion groups sometimes release samples or full archives later; sometimes listings appear and little further material follows. Neither outcome should be assumed from the listing date alone.

If data were eventually shown to have been copied, real-world risks for affected people would depend on the content. Typical concerns in this industry context include targeted phishing, social engineering that cites internal project names, fraud against businesses using stolen invoices or contracts, and long-term misuse of personal details where regulated data were present. For the organisation, an confirmed event would usually mean investigation costs, customer notification duties where the law requires them, and possible contractual follow-up. None of those outcomes are established by the current claim.

If your data was involved

Because the listing is unverified and the company has not publicly confirmed an incident as of writing, treat the following as precautions for the possibility that your information was involved—not as a statement that it was.

• Watch for unexpected password-reset messages, invoice changes, or urgent requests that cite FTAPI, secure file transfer, or a “data room” deadline; verify through a channel you already trust.
• If you use FTAPI or related services, sign in only via official bookmarks or apps, enable strong multi-factor authentication where available, and rotate passwords that were unique to those accounts if your security team advises it.
• Review bank and credit activity if you have shared financial or identity documents through business file-exchange tools, and follow your organisation’s incident or vendor-risk guidance rather than instructions in unsolicited email.
• Prefer primary notices from FTAPI or from your own employer or agency over social media forwards and leak-site screenshots, which are easy to fabricate or exaggerate.
• You can run a free exposure scan of your email to check whether your address has already appeared in known breach datasets unrelated or related to public dumps; that check does not prove involvement in this claim, but it can flag reused credentials worth changing.

In short: The Gentlemen have listed FTAPI Software; the claim is unconfirmed; scale and data types are undisclosed; and sensible hygiene is conditional on risk, not on an established inventory of stolen files.

AICompiled with AI assistance from public sources and published under our editorial standards.