Ransomware: thegentlemen claims Nobema (DE) — Technology

On 7 August 2026, the ransomware group known as thegentlemen publicly claimed responsibility for a cyberattack against Nobema, a German entity, by listing it on their leak site. The disclosure, tracked under the BREACH framework, confirms that the group has exfiltrated data and is likely using the threat of publication to extort payment. No technical details, such as the attack vector or the specific data compromised, have been released at this time.

The primary affected organisation is Nobema, a German company, but the incident has broader implications for any EU entity in manufacturing, engineering, or industrial supply chains, as these sectors are frequent targets for such groups. Additionally, any third-party vendors, clients, or partners who share data with Nobema may face secondary exposure if that information was part of the stolen dataset.

Compliance teams should immediately verify whether their organisation has any data-sharing relationship with Nobema and assess contractual notification obligations under GDPR and NIS2. If a relationship exists, activate your incident response plan, review business continuity measures, and prepare for potential regulatory reporting to the relevant supervisory authority within 72 hours if a personal data breach is confirmed. Even if unaffected, treat this as a trigger to re-evaluate your own ransomware defences, particularly around backup isolation and employee access controls, given the rising frequency of such claims.