Rola Motor Group Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Individuals who have bought vehicles, sought financing, or used servicing from Rola Motor Group face the possibility that personal and financial details held by the company have been taken. On 20 January 2026 the organisation was listed by the ransomware group thegentlemen, which stated that internal files had been removed during an attack. The number of people affected and the precise contents of the material remain unknown.

Because motor retailers routinely collect identity documents, banking information, and vehicle ownership records, any confirmed exposure could affect everyday financial and administrative activities for customers. At present the only confirmed information is the group’s listing and the claim that files were exfiltrated.

What happened

The incident was first noted publicly on 20 January 2026 when thegentlemen added Rola Motor Group to its listing of claimed victims. The group stated that internal files had been removed in a ransomware operation. No further details on the date of the intrusion, the volume of data taken, or the method of access have been released by either the organisation or the threat actor.

The group behind it: thegentlemen

Thegentlemen is a ransomware operation that maintains a public leak site where it lists organisations it claims to have compromised. Such groups typically gain initial access through phishing, remote-desktop vulnerabilities or compromised credentials, then move laterally to locate and copy data before deploying encryption. Their listings serve as a form of pressure on victims to negotiate. The appearance of Rola Motor Group on the site constitutes the group’s claim; independent confirmation of the data’s authenticity or scope has not been published.

Who is Rola Motor Group?

Rola Motor Group, established in 1963 and based in South Africa, sells new, demonstration and pre-owned vehicles and provides servicing across multiple brands. It also offers online finance pre-approval and handles the purchase and sale of cars for private customers. Organisations of this type maintain records that include customer identification, contact details, financial applications and vehicle history, all of which support sales, servicing and regulatory compliance.

What was likely exposed

The only data category named in connection with the listing is “internal files exfiltrated in ransomware attack.” The exact nature of those files has not been disclosed. Motor groups commonly store driver’s licence copies, proof of income, bank account details, addresses and service histories; whether any of these categories are present in the material claimed by thegentlemen is unconfirmed.

What's at stake

Exposure of customer records from a vehicle retailer can lead to attempts at identity misuse or targeted fraud, particularly where financial or identity documents are involved. For the organisation, the incident adds operational disruption and the need to review access controls and third-party connections. Both outcomes depend on the still-unknown contents of the files and on whether the material has been further distributed.

If your data was in this claimed breach

Monitor bank and credit accounts for unusual activity and consider placing fraud alerts with credit bureaux if financial documents were held by the company. Use strong, unique passwords and enable multi-factor authentication on any accounts linked to the same email address. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.