Intra Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 14, 2026, the ransomware group thegentlemen listed Intra on its leak site. The entry claims that internal files were exfiltrated during a ransomware attack on the Auckland-based medical clinic. The number of individuals affected remains unknown, and no further details on the volume or contents of the material have been made public. This listing adds to the pattern of ransomware operations targeting healthcare providers, where claims of data theft can create prolonged uncertainty for patients and staff even when independent confirmation is absent.

Inside the incident

The incident was first noted publicly through thegentlemen's leak-site listing on April 14, 2026. The group asserts that files were removed from Intra's systems as part of a ransomware operation. No information has been released on the date of the intrusion, the method of initial access, the duration of any encryption, or whether a ransom demand was issued or met. The scale of the claimed exfiltration and the number of records involved are not stated.

Inside thegentlemen

Thegentlemen is a ransomware group that maintains a leak site to publish data it claims to have stolen from victims. Such groups typically combine encryption of systems with the threat of public release of exfiltrated material. The listing of Intra constitutes the group's claim of responsibility; no independent verification of the intrusion or the data removal has been provided in the available facts.

Intra and its sector

Intra operates as a private centre of excellence in New Zealand for image-guided medical diagnostics and interventions. Founded in 1990 in Auckland, it focuses on interventional cardiology, electrophysiology, and interventional radiology, with more than thirty specialists and two hospital locations. Organisations of this type maintain detailed records related to procedures, patient scheduling, imaging, and clinical correspondence.

What data was at risk

The only data category named is internal files exfiltrated in a ransomware attack. The precise types of documents, whether they include patient identifiers, clinical notes, or administrative records, have not been disclosed. While medical clinics routinely hold information on procedures and patient interactions, the exact contents of the claimed exfiltration remain unconfirmed.

Why it matters

Exposure of internal files from a specialist medical provider can affect operational continuity and the privacy of individuals whose records are referenced in those files. For patients, the primary concern is the potential circulation of information that was not intended for public view. For the organisation, the incident introduces questions about data-handling practices and recovery timelines that are not yet answered in public reporting.

If your data was in this claimed breach

Monitor official statements from Intra for any guidance on next steps. Review account statements and correspondence for unusual activity. Individuals can run a free exposure scan of their email address against known breach data sets to determine whether their information appears in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.