Tooltec Listed by thegentlemen Ransomware Group: What Was Exposed & What To Do

On July 16, 2026, the ransomware group thegentlemen listed Tooltec on its site and stated that internal files had been taken in a ransomware operation. The number of individuals whose information may be involved is not known, and no further details about the volume or content of the material have been made public. Tooltec is a precision-machining company based in Trollhättan, Sweden, that supplies components to the automotive, energy, aeronautical and aerospace sectors. The incident therefore raises straightforward questions for clients, employees and business partners whose records may have been among the material removed.

Breaking down the breach

The only confirmed information is the listing itself and the group’s assertion that internal files were exfiltrated. No date of intrusion, no count of records, and no description of the encryption or exfiltration methods have been released by either the company or the group. The scale of any data removal therefore remains undisclosed.

Who is thegentlemen?

Thegentlemen is a ransomware group that maintains a public leak site where it lists organisations it claims to have targeted. Such groups typically encrypt systems and then threaten to publish stolen material if a ransom demand is not met. The listing of Tooltec constitutes the group’s claim; independent confirmation of the intrusion or of the material taken has not been provided.

Tooltec and its sector

Tooltec operates as an ISO 9001-certified supplier specialising in five-axis milling, turning and wire EDM for complex metal components. Companies in this part of the advanced-manufacturing sector routinely hold design specifications, process data, client contracts and employee records. A successful intrusion at such a firm can therefore touch both proprietary production information and personal data belonging to staff or customers.

What data was at risk

The listing refers only to “internal files.” No inventory of file types or data categories has been published. Organisations of this kind commonly store engineering drawings, quality-control records, supplier agreements and human-resources information, but the precise contents removed in this case have not been confirmed.

Why it matters

Exposure of manufacturing specifications or client-related documents can create competitive or contractual difficulties for the company and its partners. Where personal data is present, individuals may face risks of targeted fraud or identity misuse. Because the exact categories and volume of data remain unknown, the practical consequences for any specific person cannot yet be quantified.

If your data was in this breach

Individuals who have professional or commercial dealings with Tooltec should treat any unexpected requests for information or credentials with caution. Basic protective steps include monitoring bank and credit accounts for unusual activity and using unique passwords for different services. The following measures are commonly recommended after any potential exposure:

• Change passwords for accounts linked to the organisation or its partners.
• Enable multi-factor authentication wherever it is available.
• Review recent statements from banks, insurers and government services for anomalies.
• Run a free exposure scan of your email address against known breach data to check for further appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.