The Modern Flour Mill Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 6, 2026, the ransomware group thegentlemen listed The Modern Flour Mill on its leak site, claiming to have exfiltrated internal files during a ransomware attack. The number of people affected remains unknown, and the company has not issued a public statement confirming or denying the listing. Ransomware groups continue to target manufacturing and food-processing organisations as part of broader campaigns against critical supply chains. When a listing appears on a leak site, it signals that data may have left the organisation, even if the precise contents and scope are not yet verified.

Inside the incident

The only confirmed detail is the May 6, 2026 listing by thegentlemen. No information has been released about when the intrusion began, how long the attackers had access, or the volume of data involved. The reported summary states only that internal files were exfiltrated in a ransomware attack; no further technical indicators or ransom demands have been made public.

Who is thegentlemen?

Thegentlemen is a ransomware group that maintains a leak site where it lists organisations it claims to have compromised. Like other groups in this category, it typically combines data encryption with the threat of publishing stolen files if a ransom is not paid. Public records show the group has previously listed victims across multiple sectors, though independent confirmation of each claim varies.

Who is The Modern Flour Mill?

The Modern Flour Mill, also known as Modern Flour Mills & Macaroni Factories Co., is a cereal processor founded in 1949 and based in Amman, Jordan. It operates four production plants covering wheat flour milling, pasta, snack foods and bakery ingredients, and employs between 201 and 500 people. Its products are distributed under regional brands and reach both consumer and commercial markets in the Middle East.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific file types, databases or personal information has been published. Organisations of this kind routinely hold employee records, supplier contracts, production schedules and financial data, but the exact contents of any exfiltrated material remain unconfirmed.

What's at stake

For individuals whose information may be present in the files, the main risks are identity misuse or targeted fraud if personal or financial details are involved. For the organisation, exposure of operational documents could affect commercial relationships or regulatory compliance, though the scale of any such impact is not yet known. Food-production companies also hold safety and quality records whose disclosure could create secondary operational questions.

If your data was in this claimed breach

Monitor bank and credit accounts for unusual activity and consider placing fraud alerts with credit bureaus. Change passwords for any work-related accounts and enable multi-factor authentication where available. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in public listings from this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.