> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Ransomware: thegentlemen named Agospap (GR) - URL: https://f4n6.co.uk/security-feed/ransomware-thegentlemen-named-agospap-gr/ - Published: 2026-09-30T09:41:39.000Z - Updated: 2026-09-30T09:41:39.000Z - Author: Jeff Davies - Tags: #security-feed, thegentlemen ## 1\. Executive summary The ransomware and extortion group calling itself "thegentlemen" listed Agospap, a French non-profit benefits administrator for roughly 150,000 AP-HP and City of Paris staff, on its leak site on 2026-09-30\. The listing names the victim, the country (GR) and the domain agospap.com; no data sample, ransom demand, or proof-of-compromise has been published in the source material, and no CVE, exploited component, or initial-access vector is identified. There is no MITRE ATT&CK profile for "thegentlemen" in the verified reference data, so the attribution is unconfirmed and the group's tradecraft cannot be mapped to known techniques. For EMEA financial services clients the direct exposure is low unless Agospap is a payroll, benefits, or ticketing supplier in your third-party chain; the material risk is third-party and supply-chain, not a vulnerability you can patch. No CISA KEV entry, CVSS score, or EPSS value applies because no CVE is named in this item. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk — general principles | Agospap is a benefits and ticketing administrator that may sit in the supplier chain of AP-HP and City of Paris staff; if your firm or your staff use it, it is an ICT third-party dependency. | If Agospap is a registered ICT third-party provider in your DORA register, the listing triggers a third-party risk review: confirm whether any of your data or staff records are in scope, and whether the contract carries breach-notification and audit rights. | | DORA Art. 29: preliminary assessment of ICT concentration risk | The same supplier serves two large public-sector founders plus roughly 20 affiliated bodies, so a single compromise concentrates exposure across many downstream organisations. | If Agospap is a concentration point in your supplier map, assess whether the loss of its services (ticketing, grants, camp registration) disrupts any function you rely on. | | NIS2 Art. 21(2)(d): supply chain security measures | Agospap is a supplier to entities that may be in scope for NIS2, and the listing is a supply-chain security event. | If you are an in-scope entity and Agospap is in your supply chain, the article requires you to assess and manage the supply-chain risk this listing represents. | No DORA Art. 17, 18, 19, 24 or 30 row is included: those articles are engaged by an incident at your own entity or by specific contractual provisions, and this item is a third-party listing, not a confirmed incident at a client. UK NIS 2018 is not engaged because the victim is a French entity and no UK OES/RDSP is named. ## 3\. Technical analysis & attack chain No attack chain can be reconstructed from the source material. The listing confirms only that thegentlemen claims Agospap as a victim. It does not state an initial-access vector, an exploited vulnerability, a payload, a persistence mechanism, a command-and-control channel, lateral movement, or exfiltration. Writing a numbered chain here would be invention, so none is given. What the source does provide is victim and exposure context. Agospap (agospap.com) is a non-profit association under the French loi 1901, founded 2 November 1981 in Paris, that manages social, cultural and leisure benefits for approximately 150,000 staff of the AP-HP hospital system and the City of Paris, plus around 20 affiliated public bodies. It has 45 employees. Its income is tied to 0.5% of the two founders' payroll, roughly €28M per year in subsidies against a €49M total budget. Services include income-scaled holiday stays, children's camps for ages 4 to 17, a cultural ticketing platform, Christmas gifts, social grants (birth, marriage, service medals) and the Pass'Sport sports voucher. It is led by president Jean-Paul Brandela (since October 2023) and director-general Anne Schaetzel (since 2013), is ISO 9001-certified, and holds an Atout France travel-operator licence with UNAT financial guarantees. A €2M cut by the City in 2023 briefly suspended camp registrations, which indicates the funding relationship is politically sensitive. The ransomware.live index page for this victim records 610 compromised users, 0 compromised employees, 0 third-party employee credentials, and an external attack surface of 37\. These figures are single-sourced from the index page and their provenance is not stated; treat them as unverified and do not use them as a basis for scoping. The page also carries a legal disclaimer that ransomware.live does not acquire, download, host, or redistribute stolen content and indexes only publicly visible operator posts. No DNS records were returned for the victim domain in the fetched content. Attribution caveat: "thegentlemen" has no MITRE ATT&CK profile in the verified reference data. The group's identity, sponsorship, and relationship to other extortion crews are unconfirmed. Do not treat this listing as corroborated attribution to any tracked actor. ## 4\. Mitigation & containment P1 (within 24h) - If Agospap appears anywhere in your supplier, payroll-deduction, benefits, or corporate-ticketing chain, confirm with the business owner whether any of your staff data or payment flows are in scope, and record the answer. This is the only action the source supports as urgent. - Do not treat the listing as confirmed data theft. No sample, no file listing, and no exfiltration claim has been published. Escalate to incident response only if you have independent evidence of access to your own systems. - Check whether any of your staff authenticate to agospap.com or a related Agospap portal with corporate credentials. If so, force a password reset and review sign-in logs for those accounts. P2 (within 72h) - If Agospap is a registered ICT third-party provider under DORA, open a third-party risk review against Art. 28 and confirm the contract's breach-notification and audit clauses. - Ask Agospap directly, through your normal supplier contact, whether it has detected unauthorised access and whether any data relating to your organisation is affected. Do not rely on the leak-site listing as the notification. - Review outbound traffic and identity logs for any authentication to Agospap-hosted services from your estate in the last 30 days. P3 (within 7 days) - Update your supplier concentration map to reflect that Agospap serves AP-HP, the City of Paris, and roughly 20 affiliated bodies, and assess whether that concentration affects any function you depend on (DORA Art. 29). - If you are an in-scope NIS2 entity and Agospap is in your supply chain, document the supply-chain risk assessment required by Art. 21(2)(d). No vendor patch, version pin, or configuration change is available because no product, version, or CVE is named in this item. There is nothing to patch here. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The listing provides a victim name, a country code, and a domain, none of which are threat artefacts. No hashes, no network indicators, no file paths, and no behavioural telemetry are present in the sources. ## 6\. Detection Insufficient indicators to author detection rules. The sources contain no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names, registry keys, ransom-note text, or hard-coded values belonging to the threat. The only domain present, agospap.com, is the victim's own site, not an attacker artefact, and a rule matching it would detect the victim rather than the intrusion. No YARA or Sigma rule is emitted. ## 7\. Sources - ransomware.live, "Victim: Agospap – thegentlemen", https://www.ransomware.live/id/QWdvc3BhcEB0aGVnZW50bGVtZW4=, published 2026-09-30. - ransomware.live, "Victim: Agospap – thegentlemen" (index page with compromised-user and attack-surface figures), https://www.ransomware.live/id/QWdvc3BhcEB0aGVnZW50bGVtZW4=, fetched 2026-09-30. Both sources are the same platform. The victim profile, the 610 compromised users, the external attack surface of 37, and the DNS record status are single-sourced and unverified. ## 8\. Adverse Trace position We assess this as a low-severity item for most EMEA financial services clients and a moderate third-party item for any client that uses Agospap as a benefits, payroll-deduction, or ticketing supplier. The listing is a claim, not a confirmed breach: no data sample, no exfiltration evidence, and no technical detail have been published, and the attribution to "thegentlemen" is unconfirmed because the group has no MITRE ATT&CK profile in our reference data. The 610 compromised-user figure is single-sourced from the index page and should not be used for scoping. We will monitor the leak site for a data sample or proof-of-compromise that would raise the severity, and we will re-issue this advisory if Agospap confirms unauthorised access or if the group publishes victim data. Clients with Agospap in their supplier chain should complete the P1 supplier-scoping step and report back through their normal channel. --- [Read the original source →](https://www.ransomware.live/id/QWdvc3BhcEB0aGVnZW50bGVtZW4=?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*