Henry Frerk Sons Listed by thegentlemen Ransomware Group: What Was Exposed & What To Do

When a company that supplies materials for construction and historic restoration appears on a ransomware group's listing, the immediate concern is practical rather than abstract. Employees, contractors, customers, and partners may find that internal files containing their contact details, project records, or financial correspondence have been copied and held for leverage. Public detail on this incident remains limited, but the listing itself is enough to warrant attention from anyone who has done business with or worked for Henry Frerk Sons.

On July 23, 2026, the organisation was reported as listed by the ransomware group known as thegentlemen. The group claims that internal files were exfiltrated in a ransomware attack. The number of people affected is unknown, and further specifics have not been disclosed in available reporting.

Inside the incident

What is publicly recorded is straightforward: Henry Frerk Sons was named on a leak site associated with thegentlemen ransomware group, with the report dated July 23, 2026. The claim centres on the exfiltration of internal files during a ransomware attack. No confirmed figure for the volume of data, no list of specific file categories beyond the general description of internal files, and no detailed timeline of intrusion or encryption have been released in the material available for this account.

Ransomware incidents of this type typically involve unauthorised access, data theft, and an attempt to pressure the victim through the threat of publication. In this case, the public record stops at the listing and the assertion that internal files were taken. Whether the organisation has confirmed the intrusion, negotiated, or restored systems from backups is not stated in the reported facts. Scale, exact method of entry, and the current status of any stolen data remain undisclosed.

The group behind it: thegentlemen

thegentlemen is a ransomware operation that has appeared in public reporting as a group that steals data before encrypting systems and then lists victims on a dedicated leak site when payment is not forthcoming. Like other actors in this category, it relies on the dual pressure of operational disruption and the threatened release of sensitive material. Public documentation of the group describes typical tactics that include initial access through compromised credentials or vulnerable services, lateral movement, exfiltration, and deployment of ransomware payloads.

Notable prior activity attributed to the group in open sources follows the familiar pattern of naming organisations across multiple sectors and claiming possession of internal documents, databases, or correspondence. For this specific incident, the only claim on record is the listing of Henry Frerk Sons and the assertion that internal files were exfiltrated. No additional statements from the group about this victim—such as sample file releases, ransom demands, or deadlines—are included in the facts at hand. The listing should therefore be treated as an unverified claim by the actors themselves unless independently confirmed.

Who is Henry Frerk Sons?

Henry Frerk Sons, also referenced as HFS Materials, is a masonry and plaster restoration supplier based in the Chicago region. The company has more than 140 years of history and specialises in custom matching and blending of historic mortars, concrete, and stone patching materials. It also offers on-site volumetric ready-mix concrete services and supplies a range of building materials that includes natural hydraulic lime, specialised cleaners, sealers, and preblended mortars used in both historic preservation and new construction.

Organisations of this kind sit at the intersection of construction supply chains, heritage projects, and commercial contracting. They routinely hold records on employees, suppliers, project specifications, customer orders, invoicing, and site logistics. A breach affecting such a firm is consequential because the data can touch multiple parties—staff payroll and personal details, contractor agreements, client project files, and payment information—creating ripple effects beyond the company itself. The long operating history and specialised niche mean that relationships and records may span many years and numerous external partners.

The information in question

The reported facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of data types—such as employee records, customer lists, financial documents, or technical specifications—has been disclosed. Exact contents therefore remain unconfirmed.

Companies in the building-materials and restoration supply sector typically maintain personnel files, payroll data, vendor and customer contact information, purchase orders, delivery schedules, project notes, and accounting records. Some may also store drawings, material formulations, or correspondence related to historic preservation work. While these categories are common for the industry, they are not confirmed as present in the material claimed by thegentlemen in this incident. Readers should treat any specific assumption about what was taken as speculative until official clarification appears.

What's at stake

For individuals whose information may have been included, the practical risks include unwanted contact, phishing attempts that reference real projects or colleagues, and potential misuse of personal or financial details if such data were present. Even relatively mundane internal files—emails, invoices, or shipping records—can supply enough context for convincing social-engineering attacks. Employees and contractors face the additional concern that workplace documents could expose home addresses, phone numbers, or banking information used for payments.

For the organisation, the stakes involve operational continuity, contractual obligations to clients and suppliers, and the cost of investigation and recovery. Reputation with long-standing partners in the historic-preservation and construction communities may also be affected. Because the number of people affected is unknown and the precise data types are not detailed beyond “internal files,” the full scope of exposure cannot yet be measured. Both the company and any potentially affected parties are left working with incomplete information.

If your data was in this breach

If you have worked for, supplied, or purchased from Henry Frerk Sons, treat the possibility of exposure seriously even while details remain limited. Monitor financial accounts and credit reports for unfamiliar activity. Be cautious with unsolicited emails or calls that reference the company, specific projects, or colleagues; verify any such contact through known official channels. Change passwords on accounts that may have shared credentials or recovery information tied to work email, and enable multi-factor authentication where it is available.

Keep records of any suspicious communications. If you are an employee or contractor, ask the organisation’s designated security or HR contact for any guidance they are able to provide once their investigation progresses. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step will not confirm or rule out involvement in this specific incident, but it can indicate whether your details appear elsewhere and help you prioritise further protections.

AICompiled with AI assistance from public sources and published under our editorial standards.