MakoLab Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

What is known is that on July 1, 2026, the ransomware group thegentlemen listed MakoLab on its leak site, claiming to have exfiltrated internal files during a ransomware attack. The number of people affected remains unknown, and no further details on the volume or contents of the data have been made public. For clients and partners of the Polish firm, the incident raises questions about whether information shared during digital transformation or software projects has moved outside the company’s control.

What happened

The listing appeared on July 1, 2026. The group stated that internal files were taken in a ransomware operation. No confirmation of the claim has been issued by MakoLab, and no figures for the quantity of data or the number of individuals potentially affected have been released. Public records do not yet contain additional technical details about how access was obtained or whether encryption was also deployed.

Who is thegentlemen?

Thegentlemen is a ransomware operator that maintains a leak site to publish data taken from targeted organisations. Groups of this type commonly combine file encryption with the threat of public disclosure to pressure victims. The current listing constitutes the group’s claim of responsibility for the MakoLab incident; independent verification of the data’s origin or scope has not been reported.

Who is MakoLab?

MakoLab is a Polish IT consulting and software development company that functions as a digital project house. It works with enterprise clients on digital transformation initiatives, artificial intelligence applications, custom software engineering, and product design, while also supplying 24/7 operational support. Because the firm routinely receives business and technical information from large organisations, any confirmed loss of internal files could extend beyond MakoLab’s own records.

What was likely exposed

The only data category named in the listing is internal files exfiltrated during the ransomware attack. The precise nature of those files has not been disclosed.

• Project documentation and client deliverables
• Internal communications and operational records
• Technical specifications or credentials stored on company systems

No confirmation exists that personal data of individuals or specific client datasets were included.

What's at stake

Enterprise clients that shared sensitive project information with MakoLab face the possibility that such material is now held by an unauthorised party. For individuals whose details appear in those files, risks include targeted follow-on activity such as phishing or account misuse. The organisation itself must manage potential contractual obligations and any regulatory reporting requirements that arise once the scope of the data is clarified.

If your data was in this claimed breach

Monitor accounts associated with any MakoLab projects for unusual login attempts or password-reset requests. Enable multi-factor authentication on work-related services and review recent access logs where available. Individuals can run a free exposure scan of their email address against known breach datasets to check whether their information appears in public listings from this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.