Disclosure context

About thegentlemen

thegentlemen is a ransomware group that emerged in September 2025, operating with apparent financial motivations based on their broad targeting of commercial sectors. The group has documented 267 victims across multiple countries, with primary focus on the United States, Thailand, France, Brazil, and India. Their targeting strategy demonstrates a preference for high-value sectors including manufacturing, technology, healthcare, and financial services organizations. Given the group's recent emergence and limited public documentation from established threat intelligence sources such as CISA, FBI, or major security research firms, specific details regarding their country of origin, operational structure, attack methodologies, encryption techniques, and whether they employ ransomware-as-a-service models remain unclear. The relatively high victim count of 267 in a short operational timeframe since September 2025 suggests either an aggressive campaign pace or potential inflation of victim numbers through affiliate operations, though without corroborating intelligence reports, the group's exact operational capabilities and notable campaigns cannot be definitively established. Current intelligence indicates the group remains active as of late 2025, though comprehensive threat profiling requires additional validated reporting from authoritative cybersecurity sources. The group has been linked to 424 public disclosures across our corpus. First observed on a leak site on September 9, 2025; most recent post May 18, 2026. The operation is currently active.

Also tracked as: the gentlemen.

Timeline of this disclosure

May 6, 2026Triquim listed by thegentlemenon the group's public leak site

Sector and geography

This disclosure adds to ransomware activity in the Manufacturing sector, which has 2,458 disclosures indexed across all operators we track. Geographically, Triquim is reported in AR, a country with 24 ransomware disclosures in our corpus.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.

Ransomware victim disclosure

← All victims

Triquim

Claimed by thegentlemen · listed 15 days ago

14d

Age

since listed · data leaked

Status timeline

Listed
May 6, 2026
Data leaked

At a glance

Group: thegentlemen
Status: Data leaked
Country: AR
Sector: Manufacturing
Listed on leak site: May 6, 2026

About the victim

AI dossier — public-source company profile

TRIQUIM S.A. is an Argentine pharmaceutical manufacturer headquartered in Tortuguitas, Buenos Aires, founded in 1980. The company specialises in the synthesis and supply of Active Pharmaceutical Ingredients (APIs) for human and veterinary use, operating as a CMO/CDMO partner offering custom development, contract manufacturing, regulatory, and analytical services. It holds certifications from ANVISA, COFEPRIS, and NNGYK (Hungary GMP), and supplies clients across regulated and emerging markets worldwide.

Industry: Active Pharmaceutical Ingredients (API) Manufacturing & CDMO
Address: Tortuguitas, Buenos Aires, Argentina
Founded: 1980

Attack summary

Severity: high — Data has been confirmed published by the threat actor. TRIQUIM operates in the pharmaceutical sector handling proprietary API synthesis processes, regulatory documentation, and client relationships across multiple regulated markets; exposure of such data constitutes significant business and potentially sensitive industry data. While no PII at scale or medical records are explicitly confirmed, the pharmaceutical CDMO context and confirmed data publication justify a high severity rating.

The group 'thegentlemen' claims to have compromised TRIQUIM S.A. and has published data (disclosed status: data_published). The specific nature of the exfiltrated data and whether encryption occurred is not detailed in the post, but the publication status indicates data has been released.

high

Data the group says was taken

AI dossier — extracted from the leak post

Company business data
Pharmaceutical product portfolio information
Regulatory certification documents
Client/partner information
Contract manufacturing details

What the group claims

triquim.com.ar zoominfo.com/c/triquim-sa/430429498 TRIQUIM S.A. is an Argentine pharmaceutical manufacturer founded in 1980 and headquartered in Tortuguitas, Buenos Aires, that has dedicated over 40 years to the synthesis and supply of Active Pharmaceutical Ingredients (APIs) for human and veterinary use. The company operates as a CMO/CDMO partner, offering custom API development, contract manufacturing, regulatory services, containment, and analytical services to pharma clients worldwide. TRIQUIM holds certifications from Brazil's ANVISA and Mexico's COFEPRIS, and supplies clients across North America, Europe, and emerging markets with a portfolio of 16 pharmaceutical products including Benfotiamine, Bosentan, and Clonixinal

Sources

Victim sitetriquim.com.ar

Source

Indexed 15 days ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.