Peru: The Gentlemen Targets San Luis

The Gentlemen has added the Municipalidad Distrital de San Luis, in Lima, Peru, to its leak site, according to leak-site monitoring shared by IntelFusions. The mention comes as claims against South American organizations have increased. In the 30 days before Aug. 8, 2026, IntelFusions recorded 68 claims, and nine of them named a government or educational entity.

What does the monitoring show?

IntelFusions said that, during that period, activity seen on leak sites was not limited to private companies. It also identified references to public and educational entities within the total set of claims against organizations in South America. The inclusion of San Luis in Lima adds a Peruvian case to that group.

Ransomware.live, meanwhile, shows 81 victims associated with Peru on its map. That result does not by itself identify a specific group or a particular TTP. In other words, it is useful as a volume reference, but it is not enough to attribute a campaign to a specific actor.

What is known about The Gentlemen?

Security Arsenal reported 25 new victim postings on The Gentlemen’s leak site, hosted on Tor. In that analysis, the firm described the group as part of an aggressive double-extortion campaign against small and midsize businesses in North America, Europe, and Latin America. According to that report, the sectors most represented among the victims are manufacturing and professional services.

The presence of a Peruvian municipal entity on the group’s site fits that regional pattern, although the available material does not support further public attribution beyond what is visible on the leak sites.

What other case appears in the public list?

Galaxy Warden also reported that The Gentlemen listed INKA Group GmbH & Co. KG on its leak site, and said the company had not publicly confirmed the allegation. That detail reinforces a common limitation of this kind of record: a leak-site posting does not, by itself, amount to official confirmation of the incident.