Peru: The Gentlemen Targets San Luis

The Gentlemen added the Municipality of San Luis, in Lima, Peru, to its leak site, according to leak site monitoring shared by IntelFusions. The listing appears amid a rise in claims against South American organizations: in the 30 days before August 8, 2026, IntelFusions recorded 68 claims, and nine named a government or education entity.

What the monitoring shows

IntelFusions said that during that period, activity seen on leak sites was not limited to private companies. It also found references to public and educational institutions among the total claims against organizations in South America. The inclusion of San Luis in Lima adds a Peruvian case to that group.

Ransomware.live, meanwhile, shows 81 victims associated with Peru on its map, although that result by itself does not identify a specific group or a particular TTP. In other words, it serves as a volume reference, but it is not enough to attribute a campaign to a specific actor.

What is known about The Gentlemen

Security Arsenal reported 25 new victim postings on The Gentlemen’s leak site, hosted on Tor. In that analysis, the firm described the group as part of an aggressive double-extortion campaign targeting small and midsize businesses in North America, Europe, and Latin America. According to that report, the sectors that dominate the victim set are manufacturing and professional services.

The presence of a Peruvian municipal entity on the group’s site fits that regional pattern, although the available material does not allow public attribution beyond what is visible on leak sites.

Another case on the public list

Galaxy Warden also reported that The Gentlemen listed INKA Group GmbH & Co. KG on its leak site, and noted that the company had not publicly confirmed the claim. That detail reinforces a common limitation of these records, publication on a leak site does not by itself confirm the incident officially.