Gelarti Listed by The Gentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by posting names on leak sites before any independent verification occurs. In that climate, a listing is a public claim, not proof that systems were compromised or that files left the network. On September 14, 2026, the group known as The Gentlemen listed Gelarti on its leak site. Gelarti has not publicly confirmed the claim as of writing. For customers, franchise partners, and staff tied to a well-known gourmet ice-cream brand in Peru and related markets, the listing still warrants calm attention: it signals alleged extortion activity and the possibility that business information could be misused if the claim were ever substantiated.

Public detail in the listing is thin. Counts of people affected, technical method, and a clear inventory of files are not established in available material. What follows separates what the actors assert from what is known about the brand and the sector, and sets out conditional steps readers can take if they later learn their information was involved.

What the listing says

According to the leak-site entry attributed to The Gentlemen, Gelarti appears among organisations the group presents as targets. The reported date associated with the listing is September 14, 2026. The listing material referenced in public summaries points to gelarti.com.pe and to business-directory context identifying Gelarti as Peru’s leading gourmet ice-cream parlor chain, with dozens of shops and cafés in major malls, operating since 2013 through Franquicias Unidas del Perú S.A.C. (RUC 20548498181). It also notes the brand’s link to Colombia’s Popsy under the Danesi Cantagali Group and the use of the Gelarti name for international activity, including Panama and Peru.

Beyond that organisational description, the listing as reflected in the available record does not disclose how many people might be affected, which systems were supposedly involved, whether any ransom demand was made, or what files—if any—the group claims to hold. Scale, intrusion method, and timeline of alleged access remain undisclosed. The company’s own public channels have not, as of writing, confirmed that an incident occurred. A leak-site name-drop alone does not establish theft, encryption, or publication of internal data; it is an unverified assertion by the actors who posted it.

The group behind it: The Gentlemen

The Gentlemen is a ransomware and extortion-style actor known in public reporting for pairing encryption pressure with leak-site publication to coerce payment. Like other groups in this category, it typically claims access to corporate environments, threatens to release material, and uses branded sites to amplify urgency. Public coverage of such crews often describes double-extortion patterns: disrupt operations where possible, then market alleged data to raise stakes. Tactics associated with this class of actor commonly include phishing or stolen credentials, lateral movement inside networks, and staged claims on dedicated leak pages—though none of those methods are confirmed for this specific listing.

For this case, only what appears on the listing should be treated as the group’s claim about Gelarti. There is no independent confirmation in the provided facts that The Gentlemen obtained Gelarti data, that a countdown was issued, or that sample files were shown. Readers should treat the group’s marketing language as self-interested. Leak sites exist to create fear and negotiating leverage; they are not audited breach registries.

Gelarti and its sector

Gelarti is publicly described as a gourmet ice-cream and café chain with a strong footprint in Peru’s retail malls, operated through a Peruvian franchise entity and connected to the longer-running Popsy brand from Colombia’s Danesi Cantagali Group. The Gelarti name has been used where the Popsy trademark could not be registered abroad, with international activity including Panama and Peru. Food-service and franchise retail brands of this kind sit at the intersection of consumer hospitality, multi-site operations, and supply-chain partners.

A credible incident affecting such a business would matter because chains hold customer-facing loyalty and payment touchpoints, employee and contractor records across many locations, franchise and supplier contracts, and operational systems for inventory and point of sale. Even when a listing is unconfirmed, the sector’s dependence on shared IT, franchise reporting, and everyday consumer data explains why extortion crews name retail and hospitality brands: the audience for alarm is large, and trust in a consumer brand is commercially sensitive. That context explains consequence in general terms; it does not prove that Gelarti’s systems were entered or that any particular file set was taken.

What data was at risk

The facts state that data types named as exposed were not disclosed. People affected are listed as unknown. It is therefore not possible to state that any specific category of information was stolen, leaked, or published.

If files from an organisation of this type were ever taken, firms in multi-site ice-cream and café retail typically hold some mix of customer contact and loyalty details, payment-related records processed through point-of-sale providers, employee and payroll information, franchisee and supplier agreements, internal financial and inventory data, and marketing lists. Those are sector norms, not an inventory of this listing. Because the actors have not, in the available record, itemised contents, any discussion of exposure must remain conditional: the listing does not establish what, if anything, left Gelarti’s control.

Why it matters

Unverified leak-site claims still create real-world friction. Customers may worry about phishing that impersonates the brand. Staff and franchise partners may face targeted messages that reference a supposed breach to harvest credentials or payments. The organisation faces reputational pressure and the cost of determining whether the claim is empty, recycled, or tied to a genuine intrusion—work that only the company and its advisors can do with internal evidence.

If data were eventually shown to have been taken, risks would depend on the content: credential stuffing and account takeover where emails and passwords overlap other services; invoice or mandate fraud against suppliers and franchisees; social engineering that cites personal or employment details; and long-tail misuse of contact lists. None of those outcomes are established here. What the listing does establish is narrower: a named extortion group has publicly associated Gelarti with its leak site on the reported date, without confirmed victim acknowledgment and without a disclosed data inventory in the facts at hand.

Separating claim from confirmation protects readers from false certainty and protects public discussion from treating an accusation as a completed breach narrative.

If your data was involved

Until Gelarti or a regulator confirms an incident and describes scope, do not assume your information was taken. If you later receive official notice, or if you have strong reason to believe your details were held by the brand and could be implicated, treat the situation as conditional risk reduction. Use unique passwords on email and financial accounts, enable multi-factor authentication where available, and watch for phishing that cites Gelarti, Popsy, ice-cream promotions, franchise paperwork, or urgent “data breach” refunds. Prefer official company channels over links in unsolicited messages. Monitor bank and card statements for unfamiliar charges. Franchisees and suppliers should verify any change-of-payment requests through known contacts, not through email alone.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach datasets unrelated to this claim. That kind of check does not prove or disprove The Gentlemen’s listing, but it helps you see whether your email is already circulating in older dumps and whether password changes are overdue. Stay alert to official statements from the company; until those exist, the responsible stance is caution without panic, and attribution of the leak-site story strictly to the group that posted it.

AICompiled with AI assistance from public sources and published under our editorial standards.