Thg Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 27, 2026, the ransomware group thegentlemen listed Thg on its leak site and claimed to have carried out an attack that included the exfiltration of internal files. The number of individuals whose information may be involved remains unknown, and no further details on the scope or timing of the incident have been made public. Thg operates in the fields of tax advice and accountancy, with a presence noted in Luxembourg. Its work centers on guiding clients through business operations and the adoption of digital tools in financial and regulatory processes.

Inside the incident

Public reporting on the event is limited to the group’s listing of Thg. The claim states that internal files were taken during a ransomware operation, but no confirmation of the attack’s date, duration, or technical method has been released by the organization or independent investigators. The scale of any data removal is also undisclosed.

The group behind it: thegentlemen

Thegentlemen is a ransomware operator that maintains a leak site where it lists organizations it claims to have targeted. Such groups typically gain initial access through phishing, credential theft, or unpatched systems, then move laterally to locate and copy data before deploying encryption. The listing of Thg constitutes the group’s assertion of involvement; independent verification of the claim has not been reported.

About Thg

Thg provides tax and accountancy services, assisting clients with regulatory compliance and the integration of digital processes. Organizations in this sector routinely handle records that include client financial details, identification documents, and internal operational correspondence. A compromise at such a firm can therefore touch both the business itself and the clients it serves.

The information in question

The only data category named in connection with the listing is “internal files.” The precise contents of those files have not been disclosed. Firms of this type commonly store client tax returns, accounting ledgers, correspondence with tax authorities, and employee records, yet it is not confirmed whether any of these categories were among the material removed.

What's at stake

Individuals whose records appear in the files of a tax or accountancy practice may face risks of identity misuse or targeted fraud if the material reaches criminal marketplaces. The organization itself may encounter regulatory scrutiny and costs associated with investigation and remediation. Because the volume and sensitivity of the exfiltrated material remain unknown, the full extent of these consequences cannot yet be measured.

What to do if you're exposed

Anyone who has been a client of Thg or who suspects their information may be involved should monitor their financial accounts and tax filings for unusual activity. Enabling multi-factor authentication on email and financial services reduces the chance of account takeover. Individuals can also run a free exposure scan of their email address against known breach data to check whether their details have appeared in previously published incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.