Ransomware: thegentlemen claims Orsima — Technology

On 31 July 2026, the ransomware group known as thegentlemen publicly claimed responsibility for a cyberattack against Orsima, a technology firm. The claim was published on the ransomware live data-leak site, indicating that the group has exfiltrated data and is likely threatening to release it unless a ransom is paid. This is a new incident disclosure under the BREACH framework, which tracks confirmed ransomware victims and their exposure timelines.

The affected organization, Orsima, operates in the technology sector, which means its clients, partners, and any third parties relying on its software or services may face downstream supply chain risks. Compliance teams in technology, managed services, and any organisation using Orsima products should treat this as a potential third-party breach. If Orsima holds personal data of EU residents, this incident may trigger notification duties under GDPR, including reporting to supervisory authorities within 72 hours of awareness.

Compliance teams should immediately verify whether their organisation has any contractual or technical dependency on Orsima. If so, they must assess data exposure, review incident response plans, and confirm that breach notification timelines are met. Additionally, teams should monitor the ransomware group’s leak site for any published data and update their vendor risk registers to reflect this active threat. Finally, reinforce employee awareness about phishing or credential theft, as ransomware groups often exploit initial access gained through such vectors.