***.*** Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 19, 2025, the ransomware group thegentlemen listed ***.*** on its site and claimed to have stolen 1.5 terabytes of internal files from the firm. The organization is described in public records as one of Asia’s largest investment companies, managing more than 10 billion USD. No confirmation of the volume or contents has been issued by ***.*** itself, and the number of individuals affected remains unknown.

Inside the incident

The only public record of the event is the listing posted by thegentlemen. The group states that the data was taken during a ransomware operation and consists of internal files. No date of the alleged intrusion, method of access, or duration of unauthorized presence has been disclosed. The organization has not released a statement confirming or denying the claims.

Inside thegentlemen

Thegentlemen is known publicly as a ransomware operator that maintains a leak site to post names of organizations from which it claims to have obtained data. Details of its infrastructure, membership, or prior confirmed operations are not contained in the current listing. The group’s assertion that it holds material from ***.*** therefore stands as an unverified claim until corroborated by the victim or independent investigation.

Who is ***.***?

***.*** operates as an investment firm focused on private equity and alternative assets across Asia. Organizations of this type routinely collect and store documentation related to capital commitments, portfolio performance, and transaction due diligence. A compromise at such a firm can expose information that extends beyond the company itself to its investors and the companies in which it has placed capital.

The information in question

The listing describes four categories of material: investment documentation including private placement memorandums, investment memos, financial models and project budgets; a complete limited-partner database containing contact details, investment terms and non-disclosure agreements; financial statements, strategic plans and operating metrics for more than thirty portfolio companies; and documentation on at least nine active merger-and-acquisition projects. Whether additional records were taken is not stated. The precise scope and sensitivity of each file remain unconfirmed by ***.***.

What's at stake

Exposure of limited-partner records could reveal the identities and commitment sizes of institutional and high-net-worth investors. Portfolio-company data could include non-public financial results and forward-looking plans. Active deal documentation could surface details of ongoing negotiations. Any of these records, if authenticated, could be used for competitive intelligence, targeted solicitation, or attempts at further unauthorized access. The organization faces potential regulatory scrutiny and reputational effects once the claims are assessed.

If your data was in this claimed breach

Individuals or entities named in investor or portfolio records should monitor accounts and communications for unusual activity. Changing passwords associated with the firm and enabling multi-factor authentication on any linked services are immediate, low-cost steps. Organizations that receive capital calls or reporting from ***.*** may wish to verify the authenticity of future messages. Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in previously published sets.

AICompiled with AI assistance from public sources and published under our editorial standards.