VeriCon Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 9, 2026, the structural engineering firm VeriCon was listed on a leak site associated with the ransomware group thegentlemen. The listing states that internal files were exfiltrated during a ransomware attack, though the number of individuals affected and the precise contents of any data remain undisclosed in public reporting.

Such listings have become a recurring feature of the current threat landscape, where ransomware operators publish victim names to apply pressure during extortion attempts. The incident highlights the exposure risks faced by specialized engineering consultancies that handle project documentation for construction and infrastructure work.

Breaking down the breach

Public information on the incident is limited to the leak-site listing reported on May 9, 2026. The entry identifies VeriCon and claims that internal files were taken during a ransomware operation. No Reported Details have been released regarding the volume of data, the timeline of the intrusion, the encryption of systems, or any ransom demand.

The number of people potentially affected is listed as unknown. No independent confirmation of the data exfiltration or its scope has been made public beyond the group’s claim.

Inside thegentlemen

Thegentlemen is a ransomware group that maintains a leak site to publish names of organizations it claims to have targeted. Groups of this type typically operate by encrypting victim systems and threatening to release stolen files if payment is not received.

In this case the group claims responsibility for an intrusion at VeriCon through its listing. No additional statements or evidence specific to this incident have been attributed to the group in available reporting.

Who is VeriCon?

VeriCon is an independent structural engineering consultancy based in Veldhoven, Netherlands. Founded more than twenty years ago by Jos Hoonhout, the firm provides design, calculation, and drawing services for civil and utility construction projects.

The company works with building information modeling (BIM) and industrial construction, with noted expertise in prefabricated concrete and steel structures. Its client work involves detailed technical documentation on structural elements and building materials.

What was likely exposed

The only data category named in connection with the incident is internal files exfiltrated during a ransomware attack. No further breakdown of file types, project records, or personal information has been disclosed.

Engineering consultancies routinely maintain records that include client correspondence, design calculations, material specifications, and project drawings. The exact contents of any exfiltrated material in this case remain unconfirmed.

Why it matters

Exposure of internal engineering files can reveal proprietary design methods, client project details, and technical specifications that organizations prefer to keep confidential. For a firm of VeriCon’s size and specialization, such material may affect ongoing contracts and future business relationships.

Individuals or organizations named in project documentation could face secondary risks if the files contain contact information or references to specific construction sites. The absence of confirmed data volumes leaves the scale of these risks undetermined.

If your data was in this claimed breach

Monitor official communications from VeriCon for any notifications about the incident. Review account statements and project-related correspondence for unusual activity.

Individuals can run a free exposure scan of their email address against known breach data sets to check for appearances in previously published records. Changing passwords for any accounts linked to the firm and enabling multi-factor authentication remain standard protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.