Incolur Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware crews continue to pressure organisations by posting alleged victims on leak sites, often before any independent confirmation exists. Those listings function as extortion theatre as much as disclosure: they name a company, imply theft, and invite urgency from customers, partners and the press. Separating a claim from a verified incident matters, especially when the target is a named business and public detail is thin.

On August 26, 2026, the ransomware group known as thegentlemen listed Incolur on its leak site. The listing presents Incolur as an alleged victim. Incolur has not publicly confirmed the claim as of writing. How many people might be affected, what files if any were taken, and how any intrusion supposedly occurred remain undisclosed in the material available for this report. What follows treats the posting as a claim, not as settled fact.

Inside the listing

According to the listing associated with thegentlemen, Incolur appears among organisations the group has named. The reported summary tied to the claim identifies Incolur Corretajes Limitada and points to public business references, including incolur.cl and a ZoomInfo company profile entry. Beyond the act of listing and that organisational framing, the public claim does not supply a claimed timeline of intrusion, a method of access, a ransom demand amount, a file count, or a verified inventory of taken data.

People affected are unknown. Data types named as exposed are not disclosed. In practical terms, the leak-site entry establishes that a ransomware brand has chosen to name Incolur; it does not, by itself, prove that systems were compromised, that exfiltration occurred, or that any particular dataset is in criminal hands. Readers should treat scale, contents and impact as unconfirmed unless the company, a regulator or another independent source later substantiates them.

The group behind it: thegentlemen

thegentlemen is known publicly as a ransomware and extortion-oriented actor that follows a pattern common to many modern crews: encrypt or threaten encryption, claim data theft, and use a leak site to increase pressure if payment is refused. Groups in this category typically publish victim names, countdown-style pressure, and sometimes sample files as marketing for the claim. Their postings are designed to coerce; they are not audited breach reports.

Well-documented behaviour across this class of actors includes double-extortion narratives—alleging both operational disruption and data exposure—and recycling or exaggerating material when it serves leverage. None of that general pattern proves what happened in any single case. For Incolur specifically, the only incident-linked assertion available here is that thegentlemen has listed the company. Claims about what was taken from Incolur should be read as the group's assertions, not as an independent inventory.

Who is Incolur?

Incolur Corretajes Limitada is described in public business information as a Chilean import and distribution company focused on industrial supplies. It imports and distributes machine tools and accessories, abrasives such as grinding and cutting wheels, welding equipment, measuring and precision instruments, industrial gauges, and tooling used in workshops and construction. In commercial terms it operates as a B2B supplier, reselling international industrial brands into the Chilean market.

Organisations in wholesale industrial distribution sit at the junction of manufacturers, logistics partners, and professional buyers. They typically maintain supplier and customer records, commercial correspondence, shipping and customs-related documentation, pricing and credit arrangements, and internal finance and HR systems. A credible breach in this sector can matter because disruption ripples through supply chains and because business contact data and contracts are useful for fraud and competitive intelligence. That sector context explains why a leak-site claim draws attention; it does not state that Incolur's systems were actually compromised.

The information in question

The listing does not disclose which data types, if any, may have been exposed. Exact contents are unconfirmed. If files were taken from a firm of this kind, organisations in industrial import and distribution typically hold business contact details, order and invoice records, supplier agreements, logistics documents, and internal employee or contractor information. They may also hold banking or payment-related commercial data tied to trade accounts. Those are sector norms, not a statement of what thegentlemen possesses or published regarding Incolur.

Because the claim does not name datasets, no responsible account can assert that customer lists, passports, passwords, or any other specific category left the company. Conditional risk discussion is the limit of what the record supports: if commercial files were copied, B2B partners could face targeted phishing; if employee records were involved, staff could face identity or payroll-related fraud attempts. Those remain hypotheticals until verified.

Why it matters

Leak-site listings create real-world uncertainty even when unproven. Customers and suppliers may worry that emails, phone numbers or contract terms could be misused for invoice fraud, fake change-of-bank details, or tailored social engineering. Employees may wonder whether HR or payroll data is at risk. The organisation faces reputational and operational pressure from an accusation it may not have publicly addressed.

At the same time, treating an unverified listing as a full breach can spread false certainty. Criminal groups have incentives to overstate access. Recycled data from unrelated incidents sometimes appears in extortion narratives. For people connected to Incolur, the practical stakes are therefore conditional: if personal or business data related to them were involved, fraud risk rises; if the claim is empty or inflated, the main harm may be noise and anxiety. Calm verification beats panic either way.

For the wider industrial supply community in Chile and among international brands that sell through local distributors, the episode is a reminder that extortion crews target mid-market B2B firms as readily as household names. A listing does not establish negligence or prove defensive failure at Incolur; it establishes only that a named group has made a public claim.

Steps worth taking either way

If you do business with Incolur or work there, proceed on a precautionary basis without assuming your data is confirmed stolen. Treat unexpected emails, payment-change requests or urgent “account” messages with scepticism; verify through known phone numbers or official channels. Watch bank and credit activity if you have shared identity or financial details in a commercial relationship. Prefer unique passwords and multi-factor authentication on email and procurement portals so a leaked password elsewhere is less useful. If you are an employee, follow only internal guidance from official company contacts regarding any incident response.

Because public detail on this listing is limited and Incolur has not publicly stated the incident as of writing, there is no basis to tell individuals that their information is definitely out. If you want a practical check nonetheless, you can run a free exposure scan of your email to see whether that address has already appeared in known breach datasets unrelated to—or possibly overlapping with—this claim. Stay alert to follow-up statements from the company or competent authorities, and adjust only when facts, not leak-site marketing, become clearer.

AICompiled with AI assistance from public sources and published under our editorial standards.