Infinite Tiers Group Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In early 2026, the ransomware group thegentlemen listed Infinite Tiers Group on its leak site, claiming to have exfiltrated internal files from the company. The listing was reported on 6 February 2026. No figure has been released for the number of individuals affected, and the company has not confirmed the incident or the extent of any data removal.

Such listings have become a routine feature of the current ransomware landscape, where groups combine encryption with the threat of disclosure to pressure victims. The absence of Reported Details on scale or impact leaves open questions about the reach of any exposure.

What happened

The only public record is the listing itself. Thegentlemen posted Infinite Tiers Group as a victim and stated that internal files had been taken during a ransomware operation. No date of intrusion, volume of data, or list of specific file types has been disclosed by either the group or the company. It remains unconfirmed whether the files were published or whether any ransom demand was met.

Inside thegentlemen

Thegentlemen is one of several ransomware operations that maintain a public leak site to name victims and, in some cases, release samples of stolen material. These groups typically gain initial access through phishing, exposed remote services, or compromised credentials, then move laterally to locate and copy data before deploying encryption. Their listings serve both as leverage and as a signal to other potential targets. Prior activity by the group has followed this pattern, though the accuracy of any individual claim varies and requires independent verification.

Who is Infinite Tiers Group?

Infinite Tiers Group, operating as ITG Software, Inc., develops and supplies integrated business software systems described as mission-critical for its clients. The company emphasises custom design and long-term applicability of its platforms. Organisations in this sector routinely process operational records, client configurations, financial data, and internal project documentation that support core business functions for other companies.

A successful intrusion at such a provider can therefore touch not only the firm’s own records but also information belonging to its customers, amplifying the potential reach of any exfiltration.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file categories, database extracts, or customer records has been published or confirmed. Companies that build and maintain business software commonly hold source code, configuration files, user credentials, support tickets, and contractual documents. Whether any of these categories were among the claimed files remains unconfirmed.

What's at stake

For individuals whose information appears in the exfiltrated material, the primary concerns are misuse of credentials or personal identifiers in further attacks. For the organisation and its clients, exposure of internal systems documentation can aid subsequent targeting or reveal operational dependencies. The lack of a confirmed count of affected records makes it difficult to assess the breadth of these risks at present.

If your data was in this claimed breach

Monitor accounts for unusual login attempts and consider changing passwords, especially for any services linked to ITG Software systems. Enable multi-factor authentication where available and review bank and credit statements for anomalies. Individuals can also run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.