Verbux Listed by The Gentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware crews continue to use public leak sites as pressure tools, posting company names and countdown clocks whether or not independent verification ever follows. In that climate, a new listing can spread faster than facts, and readers need a clear line between what a criminal group asserts and what has been established.

On August 26, 2026, the ransomware group known as The Gentlemen listed Verbux — Verbux Soluciones Informáticas Limitada, a Chilean IT services firm — on its leak site. The listing is an accusation by the group. As of writing, Verbux has not publicly confirmed that an incident occurred, and public detail on scope, method, and any data involved remains limited. That distinction matters for anyone who works with the firm or whose information might sit in systems of this kind.

Inside the listing

According to the leak-site listing attributed to The Gentlemen, Verbux appears among organizations the group claims to have targeted. The reported date associated with the listing is August 26, 2026. The number of people who might be affected is unknown. The types of data the group says it holds are not disclosed in the material available for this account.

No public technical write-up, regulator notice, or company statement confirming theft, encryption, or publication of Verbux systems or files is part of the record described here. Timing of any alleged intrusion, how access was supposedly gained, whether a ransom demand was made, and whether any files were actually released are undisclosed. A leak-site entry establishes that a named crew chose to put a company name in public view; it does not, by itself, prove what happened inside the organization’s network.

References tied to the listing point to verbux.com and related business-directory material identifying Verbux Soluciones Informáticas Limitada, including an address in Providencia, Santiago, Chile, and the domain verbux.cl. Those identifiers help place which organization the group named; they are not independent proof of a breach.

The group behind it: The Gentlemen

The Gentlemen is a ransomware and extortion actor known in public reporting for double-extortion style operations: encrypting environments where they can, and threatening to publish stolen data on a dedicated leak site if payment is not made. Like other groups in this category, they rely on visibility — naming victims, posting samples or file lists when it suits them, and setting deadlines — to increase pressure on the organizations they claim to have hit.

Public tracking of such crews generally describes opportunistic and targeted intrusion paths familiar across the ransomware ecosystem (stolen credentials, exposed remote access, and exploitation of unpatched services among the patterns defenders watch for), followed by attempts to move laterally and stage data before deployment of ransomware. Specific claims The Gentlemen makes about any single victim should still be read as the group’s own marketing and coercion, not as audited findings.

In this case, the only incident-specific assertion available in the facts is that the group listed Verbux. Nothing in those facts confirms that The Gentlemen successfully exfiltrated Verbux data, or that any particular archive will appear online. Treat the listing as an unverified claim unless and until the company, a regulator, or another independent source corroborates it.

Verbux and its sector

Verbux is described in public business information as a Chilean IT company, Verbux Soluciones Informáticas Limitada, operating since 2001 and headquartered at Juana de Arco Nº2012, Oficina 33, Providencia, Santiago, Chile. It presents itself as a provider of IT infrastructure, engineering and professional IT services, cloud computing, IoT, and SCADA-oriented process-control solutions for industrial, mining, and power-generation clients. Directory-style summaries credit the firm with a large number of implemented IT solutions, from file servers through high-availability data-center work, and note work toward ISO 9001:2015 quality management.

Firms in this niche sit at a sensitive junction: they often design, host, or support systems that industrial and energy clients depend on for operations and monitoring. A credible compromise at an IT or OT-adjacent services provider can matter not only for the provider’s own staff and finance systems, but for trust in projects and environments where availability and integrity are critical. That sector context explains why a leak-site name-drop draws attention — not because the listing has been proven, but because the role such companies play makes any serious claim worth watching carefully and verifying before conclusions are drawn.

The information in question

The listing material available for this report does not name exposed data types. Exact contents, if any, are unconfirmed. It is therefore not accurate to state that particular categories of Verbux or client information were stolen or published.

If files from an organization of this type were ever taken, firms in IT infrastructure, cloud, and industrial/SCADA project work typically hold some mix of employee records, customer and prospect contacts, contracts and commercial documents, system and network documentation, credentials or configuration material used in delivery, and project data tied to industrial, mining, or power-generation clients. Those are sector norms, not an inventory of this incident. Without disclosure from the company or a verified dump analysis, no one outside the attackers’ claims can say what, if anything, left Verbux’s control.

What's at stake

For individuals, the practical risk is conditional. If employee or contractor personal data were involved in a real incident, common concerns would include phishing that impersonates Verbux or its clients, password reuse against other accounts, and fraud attempts that misuse internal jargon or project names. If client or partner documents were involved, counterparties might face business-email compromise attempts, competitive exposure of commercial terms, or social engineering aimed at industrial and energy operators who trust the provider’s brand.

For the organization, an unverified leak-site listing still creates reputational and operational pressure: customers may ask for assurances, insurers and partners may request evidence of controls, and staff may need clear internal guidance while facts are sorted out. None of that requires assuming negligence; it follows from how extortion crews use publicity. Until confirmation or credible technical evidence appears, the sober stance is that the claim is unresolved and that overstating certainty helps the attackers’ narrative more than the public’s understanding.

What to do now

If you have a relationship with Verbux — as staff, contractor, or client — watch for official notices from the company through channels you already trust, and treat unsolicited messages that cite a “breach” or urge urgent payment or credential entry with skepticism. If you used the same password on work-related and personal accounts, change the personal ones and enable multi-factor authentication where you can. Monitor bank and identity accounts for unusual activity if you have reason to believe your personal data was held in systems that might be in scope, and document any suspicious contact.

Do not assume your data is in criminal hands solely because a group posted a company name. If files were never taken, or if your information was not among them, panic only adds noise. As a routine hygiene step, you can run a free exposure scan of your email address to check whether that address has already appeared in known breach datasets elsewhere — useful baseline awareness, separate from this unconfirmed listing. Stay with primary sources: company statements, regulator alerts, and careful reporting that keeps claims labeled as claims until evidence catches up.

AICompiled with AI assistance from public sources and published under our editorial standards.