Wentworth Listed by genesis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 30, 2026, the ransomware group genesis listed Wentworth on its leak site, stating that internal files had been exfiltrated during a ransomware attack. The number of individuals affected has not been disclosed, and no further technical details about the intrusion have been made public. Ransomware operations that combine encryption with data theft remain a persistent feature of the threat landscape, with groups frequently publishing victim names to pressure organizations into payment. The Wentworth listing follows this pattern but provides limited verified information beyond the group’s claim.

Inside the incident

The only confirmed detail is the May 30, 2026 listing by genesis, which asserts that internal files were taken from Wentworth. No information has been released on the date of the intrusion, the method of initial access, the volume of data involved, or whether any files were subsequently published. The number of people affected is listed as unknown.

Inside genesis

Genesis is a ransomware group that has appeared in public reporting for several years. Such groups commonly operate a double-extortion model, first encrypting systems and then threatening to release stolen data if a ransom is not paid. They maintain leak sites where they list organizations they claim to have compromised. The listing of Wentworth constitutes the group’s assertion of involvement; independent confirmation of the claim has not been provided in available reporting.

Who is Wentworth?

Wentworth is described as the DC Metro area’s premier design-build firm. Organizations in this sector manage construction projects from design through completion and routinely handle project documentation, client records, vendor agreements, and internal operational materials. A breach at such a firm can expose information that extends beyond the company itself to clients, subcontractors, and project partners.

What data was at risk

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific file types or data categories has been released. Design-build firms typically maintain records that include project specifications, financial documents, employee information, and communications with clients and regulators. The precise contents of the exfiltrated material remain unconfirmed.

The real-world impact

Exposure of internal files can create downstream risks for individuals whose information appears in project or personnel records, including potential misuse for fraud or targeted follow-on attacks. For the organization, the incident may affect client relationships, regulatory compliance obligations, and the cost of investigation and remediation. Because the scale and sensitivity of the data are not yet known, the full extent of these effects cannot be assessed from public information.

If your data was in this claimed breach

Individuals who have worked with Wentworth or similar firms should monitor their accounts for unusual activity and consider enabling multi-factor authentication where available. A practical first step is to review any recent communications from the company regarding the incident. Readers can also run a free exposure scan of their email address against known breach data to determine whether their information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.