Futue Bath Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Futue Bath was listed today, 13 February 2026, by thegentlemen ransomware group, which claims to have stolen internal files. Anyone connected to the organisation should review their accounts and security notices without delay.
Futue Bath, a Spanish manufacturer and distributor of high-end bathroom and kitchen furniture, was listed by the ransomware group thegentlemen on or around February 13, 2026. The listing states that internal files were exfiltrated during a ransomware attack. No confirmed count of affected individuals has been published, and the company has not issued a public statement detailing the scope or contents of any data involved.
Breaking down the breach
The only confirmed public information is the group’s listing of futurbath.com and the assertion that files were taken. No timeline for the intrusion, volume of data, or method of access has been disclosed. It remains unknown whether the files were published, offered for sale, or used in any further activity beyond the initial claim.
The group behind it: thegentlemen
Thegentlemen is a ransomware operation that maintains a leak site where it lists organizations it claims to have compromised. Such groups typically gain initial access through phishing, remote-desktop vulnerabilities, or stolen credentials, then move laterally to locate and copy data before deploying encryption. Their public listings serve as pressure on victims to pay a ransom; the accuracy of each claim is verified only when the victim or independent researchers confirm the data’s origin.
Who is Futue Bath?
Futue Bath, operating as Futurbath, is a consolidated Spanish company with more than 25 years of experience in the design, production, and wholesale distribution of bathroom and kitchen furniture, accessories, and ceramics. Headquartered in Fuenlabrada, Madrid, it maintains factories in Spain and Asia and a central warehouse to control its supply chain. Companies of this type routinely store supplier contracts, customer order histories, product specifications, and internal financial records.
What was likely exposed
The listing refers only to “internal files.” No inventory of specific data categories—such as customer names, payment details, employee records, or design documents—has been released. Organizations in the manufacturing and wholesale sector commonly hold contact information for trade clients, pricing agreements, and logistics data, but the precise contents of the exfiltrated material remain unconfirmed.
What's at stake
Exposure of internal commercial files can reveal supplier terms, customer lists, or product designs that competitors might exploit. If personal data of employees or business partners is present, those individuals could face increased phishing or fraud attempts. The organization itself may incur costs for investigation, remediation, and potential regulatory notifications under Spanish and EU data-protection rules.
What to do if you're exposed
Monitor bank and credit accounts for unusual activity and consider placing fraud alerts with credit bureaus. Use a unique password and enable multi-factor authentication on any account that may have been referenced in company records. Individuals can run a free exposure scan of their email address against known breach data sets to check whether their information appears in publicly reported incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Gaposa Listed by thegentlemen Ransomware GroupIndustrias Iberia Listed by thegentlemen Ransomware GroupCPQ Ingenieros Listed by thegentlemen Ransomware GroupExcel Cell Electronic Listed by thegentlemen Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Futue Bath Listed by thegentlemen Ransomware Group →
Publicly posted by thegentlemen — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.