Mercado Libre Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 7, 2026, the ransomware group thegentlemen listed Mercado Libre on its leak site, claiming responsibility for a ransomware attack that resulted in the exfiltration of internal files. The number of individuals affected remains unknown, and no further details on the scale or method of the intrusion have been publicly confirmed.

Such listings have become a standard element of ransomware operations, where groups publish victim names to pressure organizations into negotiations. The incident highlights ongoing risks to large digital platforms that hold extensive records of commercial and financial activity.

What happened

The incident was first reported on July 7, 2026, when thegentlemen added Mercado Libre to its leak site. The group states that it carried out a ransomware attack and exfiltrated internal files. No information has been released on the date of the intrusion itself, the volume of data taken, or whether any systems were encrypted. The number of people whose information may be involved is not known.

The group behind it: thegentlemen

Thegentlemen is a ransomware operator that maintains a public leak site to list organizations it claims to have compromised. Groups of this type typically gain initial access through phishing, stolen credentials, or unpatched systems, then move laterally to locate and extract data before deploying encryption. Their public listings serve as a form of leverage in extortion attempts. No independent confirmation of thegentlemen's specific claims regarding Mercado Libre has been reported.

About Mercado Libre

Mercado Libre operates the leading e-commerce and fintech platform in Latin America, with its Argentine subsidiary handling a significant share of national online marketplace activity. Founded in 1999, the company integrates marketplace services with Mercado Pago for payments and Mercado Envíos for logistics. Organizations of this scale routinely process high volumes of buyer and seller data, transaction records, and account information that support both retail and financial services across the region.

What data was at risk

The only detail released is that internal files were allegedly exfiltrated. The precise contents of those files have not been disclosed. Companies in this sector commonly maintain customer account details, transaction histories, seller records, and internal operational documents; however, it is not confirmed whether any of these categories were among the material taken in this case.

The real-world impact

Exposure of internal files can create downstream risks for individuals whose records appear in those documents, including potential misuse of account or transaction data. For the organization, the incident may lead to operational disruption, investigative costs, and regulatory scrutiny. Because the exact scope remains unknown, the full extent of consequences for users or the company cannot yet be assessed.

What to do if you're exposed

Monitor accounts linked to Mercado Libre for unusual activity and enable any available multi-factor authentication. Review bank and payment statements for unauthorized transactions. Individuals can run a free exposure scan of their email address against known breach data to check whether their information has appeared in public listings from incidents such as this one.

AICompiled with AI assistance from public sources and published under our editorial standards.