# Agrocampo breached by thegentlemen ransomware gang

Published: 2026-09-26 · Severity: high · Sectors: manufacturing
Canonical: https://vorant.io/reports/80089801-7aa1-5508-8d1c-eb513763c13e/agrocampo-breached-by-thegentlemen-ransomware-gang

> Agrocampo suffered a data breach with 2082 compromised users and employee credentials exposed by thegentlemen.

Agrocampo, an agricultural company, has been listed as a victim by the thegentlemen ransomware gang. According to public reporting indexed by Ransomware.live, the breach involved compromise of 2 employees, 2082 users, and 7 third-party employee credentials. The attackers also identified 101 items on the victim's external attack surface during reconnaissance. The breach appears to follow a typical ransomware extortion pattern where threat actors exfiltrate data before encryption and list victims publicly to pressure ransom payment. Defenders should assume infostealer infections may have preceded the ransomware deployment, as the reporting highlights the connection between compromised credentials and ransomware attacks.

## Mentioned in this report

- Threat actors: The Gentlemen
- Malware: Gentlemen

Source reporting: https://www.ransomware.live/id/QWdyb2NhbXBvQHRoZWdlbnRsZW1lbg==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/80089801-7aa1-5508-8d1c-eb513763c13e/agrocampo-breached-by-thegentlemen-ransomware-gang.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup