# Ransomware group TheGentlemen lists small marble firm Published: 2026-10-09 · Severity: elevated · Sectors: manufacturing Canonical: https://vorant.io/reports/e59c0088-a498-5ea9-a0ea-8e20770b9035/ransomware-group-thegentlemen-lists-small-marble-firm > Ransomware group 'TheGentlemen' claims small Colorado marble restoration company Polishing Proz as a victim on its extortion site. Ransomware.live indexed a new victim listing attributed to the ransomware extortion group operating under the alias 'thegentlemen'. The claimed victim is Polishing Proz LLC, a very small (3-6 employee) family-owned marble and stone restoration business based in Centennial, Colorado, with an estimated annual revenue of $200K-$500K. The listing was discovered on 2026-10-09 with an estimated attack date of 2026-10-06. The entry contains no technical details of the intrusion — no malware name, no initial access vector, no exfiltrated data samples, and no confirmed cloud/SaaS exposure was detected for the victim's domain (polishingproz.com). This appears to be a standard double-extortion naming-and-shaming post typical of ransomware leak sites, used to pressure the victim into payment, rather than a detailed technical disclosure. Given the victim's small size and the complete absence of technical indicators, exploited vulnerabilities, or confirmed data leakage in the source material, this is a low-severity, low-impact listing from a defender's perspective. Organizations should treat this primarily as evidence of the 'thegentlemen' group's continued activity rather than as actionable technical threat intelligence. ## Mentioned in this report - Threat actors: The Gentlemen 1 more detection for this report is in the app: the rules that match its indicators, every rule converted to Splunk SPL and Elastic, Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free. Source reporting: https://www.ransomware.live/id/UG9saXNoaW5nIFByb3pAdGhlZ2VudGxlbWVu --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e59c0088-a498-5ea9-a0ea-8e20770b9035/ransomware-group-thegentlemen-lists-small-marble-firm. In the app the same report carries its extracted indicators, its detections with Splunk SPL and Microsoft KQL already written, live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup