ICET Studios Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose personal or professional details may sit inside ICET Studios’ systems now face a concrete uncertainty: a ransomware group has publicly claimed the company as a victim and says it has taken internal files. With the number of individuals affected still unknown and the precise contents of those files unconfirmed, anyone who has worked with, been employed by, or contracted for the Italian scenography and production firm has reason to treat the claim seriously and to watch for signs of misuse of their information.

The listing appeared on 14 October 2025. Until ICET Studios or independent investigators provide further verification, the only public statement is the group’s own assertion that data was exfiltrated during a ransomware attack. That claim alone is enough to warrant practical caution for those who may be involved.

What happened

On 14 October 2025, the ransomware group known as thegentlemen listed ICET Studios on its leak site. The group claims that internal files were exfiltrated as part of a ransomware attack against the organisation. Public reporting does not disclose how the attackers gained access, whether systems were encrypted, the volume of data taken, or any ransom demand. The number of people whose information may be involved remains unknown. At present the incident is known only through the group’s listing; no independent confirmation of the breach’s full scope has been released in the available record.

Who is thegentlemen?

thegentlemen is a ransomware operation that has appeared in public threat reporting as a double-extortion group: it encrypts victim systems and simultaneously steals data, then threatens to publish the material if payment is not made. Like other contemporary ransomware crews, it typically advertises victims on a dedicated leak site and releases samples or full archives when negotiations fail or deadlines pass. The group has been observed targeting organisations across multiple sectors and geographies. Its public listings are claims made by the attackers themselves; they are not independent audits. In this case thegentlemen asserts that it holds internal files belonging to ICET Studios; that assertion has not been corroborated by the organisation or by third-party forensic disclosure in the facts available.

ICET Studios and its sector

ICET Studios is an Italian company specialising in the design and construction of scenography for cinema, television and advertising, as well as the organisation and management of events and trade fairs. According to its own public description, it maintains in-house teams of carpenters, painters, decorators, blacksmiths, electricians and assemblers, together with staff experienced in production planning and logistics, and offers turnkey services both in Italy and abroad. Companies of this type routinely hold project files, client contracts, employee and contractor records, supplier details, financial documents and operational schedules. A breach affecting such an organisation can therefore touch not only the firm itself but also the wider network of film, television, advertising and event professionals who rely on it.

The information in question

The only data category named in the public record is “internal files exfiltrated in ransomware attack.” No further breakdown—such as whether employee records, client lists, financial data, design files or personal contact details are included—has been disclosed. Organisations that design and build sets and manage productions typically store a mixture of commercial contracts, personnel information, technical drawings, invoices and correspondence. Because the exact contents remain unconfirmed, it is not possible to state which specific categories of personal or business data, if any, have left the company’s control. Affected individuals should therefore assume that any information they previously shared with ICET Studios could be among the material the group claims to hold, until clearer inventories are published.

Why it matters

For people whose details may be involved, the practical risks include targeted phishing that references real projects or colleagues, identity-related fraud if personal identifiers were present, and unwanted contact from third parties who obtain the data. For the organisation, the consequences can include operational disruption, loss of client confidence, contractual or regulatory obligations to notify partners, and the ongoing threat that the stolen files will be sold or published. Because the scale of the incident is still unknown, both individuals and the company face an open-ended period of uncertainty rather than a neatly bounded event. Calm monitoring and basic protective steps remain the most useful responses while further facts emerge.

What to do if you're exposed

If you have worked with, been employed by, or supplied services to ICET Studios, treat any unexpected emails, calls or messages that reference the company or its projects with caution. Change passwords on accounts that may have been reused or shared in a professional context, enable multi-factor authentication wherever it is available, and monitor financial and credit statements for unusual activity. Keep records of any suspicious contact. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets; such a scan does not prove involvement in this specific incident, but it can indicate whether the same address has surfaced elsewhere and help prioritise further precautions.

AICompiled with AI assistance from public sources and published under our editorial standards.