McCarthy Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 9, 2026, the ransomware group thegentlemen listed McCarthy on its leak site, stating that internal files had been taken during an attack on the company. The number of people whose information may be involved is not known, and no further details about the scope or timing of the incident have been made public. This development leaves customers, partners, and employees of the Georgia-based supplier without clear information about whether their records were among the material removed.

Breaking down the breach

The only confirmed detail is the listing itself, which attributes the removal of internal files to a ransomware operation. No figure has been released for the volume of data, the number of records, or the date the access occurred. McCarthy has not issued a public statement confirming or disputing the claim, and no regulatory filing or law-enforcement notice has been referenced in available reports.

Inside thegentlemen

Thegentlemen is a ransomware group that maintains a leak site where it lists organizations it claims to have targeted. Such groups typically gain initial access through phishing, remote-desktop vulnerabilities, or compromised credentials, then move laterally to locate and copy data before deploying encryption. Their public listings serve as pressure on victims to negotiate, though independent verification of each claim is often unavailable at the time of posting.

McCarthy and its sector

McCarthy, Inc. was founded in 1955 and is based in Savannah, Georgia. It supplies metal and wood doors, hardware, partitions, signage, and related building products to projects in healthcare, education, government, manufacturing, and hospitality. Companies in this sector routinely exchange project specifications, pricing, delivery schedules, and contact details with architects, contractors, and facility managers across multiple states.

The information in question

The listing refers only to “internal files.” The exact categories of data have not been disclosed. Organizations of this type commonly store customer order histories, vendor contracts, employee records, project drawings, and financial documents. Until a more detailed inventory is released, the presence of any particular data type remains unconfirmed.

Why it matters

Even without a confirmed count of affected individuals, the exposure of internal files can create downstream risks. Project documents may contain contact information or site details that could be used for targeted follow-on activity. For the company, the incident adds operational disruption and potential regulatory scrutiny under state data-breach notification laws, regardless of whether personal data is ultimately shown to have been taken.

Were you affected?

Begin by watching for any direct notice from McCarthy or its partners. Review recent account statements and project correspondence for unexpected activity. Individuals can also submit their email address to a free exposure-checking service that compares it against known breach data sets; results indicate only whether the address has appeared in previously published lists, not whether it was part of this specific incident.

AICompiled with AI assistance from public sources and published under our editorial standards.