TheGentlemen Ransomware Lists Multiple New Victims Across Healthcare, Logistics, and Manufacturing in June 2026 Leak Site Postings — Multi-Sector Campaign Active

Breachsense and ransomware.live tracked a fresh wave of TheGentlemen victim postings on or around June 9, 2026, spanning Central Arkansas Pediatrics, FESCO Adecco (China-based HR firm), Goldlion (Hong Kong consumer goods), Integrated Distribution (logistics), and IP Rings (India manufacturing) — consistent with the group's declared indiscriminate global targeting strategy across 20+ industries with no geographic exclusions outside CIS. The cluster of postings across healthcare, HR, and supply chain sectors in a single 24-hour window reflects the group's affiliate-driven mass-compromise model fueled by pre-positioned FortiGate access. Defenders should treat any unpatched FortiGate device (CVE-2024-55591) as an active initial access vector for this group, and review whether the California Association of Food Banks and Global Schools Foundation — also listed contemporaneously — signal expanded NGO and education-sector targeting.

The cluster of postings across healthcare, HR, and supply chain sectors in a single 24-hour window reflects the group's affiliate-driven mass-compromise model fueled by pre-positioned FortiGate access.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.