SATS Sports Club Sweden Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 22, 2026, the ransomware group thegentlemen listed SATS Sports Club Sweden in connection with an incident in which internal files were allegedly exfiltrated. The number of individuals affected has not been reported, and no additional details on the volume or contents of the material have been made public.

The listing indicates that the organisation was targeted in a ransomware operation, though confirmation of the events beyond the group’s claim remains limited to the reported exfiltration of internal files.

Inside the incident

The incident centres on SATS Sports Club Sweden. Public information states that internal files were removed during a ransomware attack and that thegentlemen subsequently listed the organisation. No figures for the quantity of data, the precise date of the intrusion, or the technical method used have been disclosed. The scale of any operational disruption inside the organisation is also unreported.

The group behind it: thegentlemen

Thegentlemen is a ransomware group that maintains a leak site where it lists organisations it claims to have compromised. Such groups commonly encrypt systems and copy data before demanding payment, then publish victim names to increase pressure. The listing of SATS Sports Club Sweden constitutes the group’s claim of involvement; independent verification of the underlying events has not been provided in the available facts.

SATS Sports Club Sweden and its sector

SATS Sports Club Sweden forms part of SATS, the largest fitness chain in the Nordics. Founded in Sweden in 1995, the group operates under the brands SATS, ELIXIA and Fresh Fitness and runs more than 274 clubs across Norway, Sweden, Finland and Denmark. It serves approximately 733,000 members and employs around 10,000 people. Fitness operators routinely hold records relating to membership, payments, class bookings and staff administration.

A breach at an organisation of this size affects a large membership base across several countries and involves data that can remain useful to malicious actors for extended periods.

The information in question

The only data type named in connection with the incident is internal files exfiltrated during the ransomware attack. No further breakdown of file categories or specific data fields has been released. Organisations in the fitness sector typically store member contact details, payment information, health and attendance records, and employee data, yet the exact contents of the exfiltrated material in this case remain unconfirmed.

The real-world impact

Individuals whose information appears in internal files face the possibility of their details being used in phishing campaigns, identity-related fraud or further targeted activity. The organisation may incur costs related to investigation, notification and remediation, and may experience temporary operational constraints while systems are restored. Because the number of affected people and the precise data fields remain unknown, the full extent of these consequences cannot yet be quantified.

If your data was in this claimed breach

Monitor bank and credit accounts for unusual activity and consider placing fraud alerts with relevant credit agencies. Change passwords for any SATS-linked services and enable multi-factor authentication where available. Readers can run a free exposure scan of their email address against known breach data to check whether their information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.