Ransomware: thegentlemen named Deloitte (US)

1. Executive summary

On 2026-10-09 the ransomware.live leak site listed Deloitte (US) as a victim of the group calling itself "thegentlemen", with the victim entry marked "Data info - soon" and no data published at the time of writing. The same listing carries a Hudson Rock credential-exposure panel claiming 615 compromised employees, 10,808 compromised users, 1,134 third-party employee credentials, 300,093 passwords (11,800 rated critical) and 22,773 cookies (1,179 rated critical) against the deloitte.com domain. No CVE, no exploited component and no malware sample is identified in the source material, so this advisory cannot describe an intrusion mechanism. The risk to EMEA financial services is indirect but material: Deloitte is an audit, assurance and advisory provider to regulated firms, and the same actor's victim list is dominated by accounting, fiduciary and wealth-administration businesses in the UK, Switzerland, Finland, Greece and Austria. The actor "thegentlemen" has no MITRE ATT&CK profile in our reference data, so the attribution is unconfirmed and the group's tradecraft cannot be characterised from verified sources.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 28: ICT third-party risk, general principles	A named ICT and professional-services provider to financial entities appears on a ransomware leak site, and the listing claims 1,134 third-party employee credentials in scope	Clients using Deloitte for audit, assurance or advisory functions should confirm whether that engagement is a contractual ICT service under their register of information, and request the provider's incident status directly rather than relying on the leak-site entry
DORA Art. 29: preliminary assessment of ICT concentration risk	The same actor's victim set is concentrated in accounting, fiduciary and fund-administration firms across multiple EMEA jurisdictions, several of which serve the same regulated client base	Where a client's outsourced audit, tax or fund-administration chain routes through more than one of these providers, the concentration exposure is worth re-examining; this is a preliminary assessment trigger, not a concluded finding
NIS2 Art. 21(2)(d): supply chain security measures	The listing asserts third-party employee credentials were exposed, which is a supply chain security fact rather than a direct compromise of the client	Entities in scope of NIS2 should treat the third-party credential claim as a supply chain security input and verify it with the provider; the claim is single-sourced to the leak-site panel and is not corroborated

No DORA Art. 17, 18, 19 or 24 trigger is engaged on the facts available: there is no confirmed incident at a client, no confirmed major incident classification, and no testing obligation arising from a leak-site listing alone. UK NIS 2018 duties are not engaged by this item on the evidence available.

3. Technical analysis & attack chain

There is no confirmed attack chain in the source material. The primary item is a leak-site listing with a victim name, a country, a website and the placeholder text "Data info - soon". No initial access vector, no exploited component, no CVE, no payload, no persistence mechanism, no command-and-control detail and no exfiltration method is stated. The listing does not claim data has been published.

What the listing does assert, and what a defender can act on, is the credential-exposure panel attributed to Hudson Rock:

The panel reports 615 compromised employees and 10,808 compromised users associated with deloitte.com.
It reports 1,134 third-party employee credentials, which is the figure most relevant to supply chain exposure.
It reports 300,093 passwords, of which 11,800 are rated critical, and 22,773 cookies, of which 1,179 are rated critical.
It reports an external attack surface count of 200.

These are infostealer-derived credential counts, not evidence of a network intrusion. Hudson Rock's own sponsorship banner on the page describes its tooling as tracking how infostealer infections lead to ransomware attacks, which is consistent with the panel being assembled from stealer logs rather than from the actor's intrusion. Treat the counts as an exposure indicator requiring validation, not as a confirmed breach scope.

The listing is also flagged by ransomware.live as a duplicate entry. The site notes that the same organisation can be targeted multiple times by the same or different groups and that separate legitimate entries may exist. We cannot determine from the source whether this is a genuine second listing, a re-post, or a data-quality artefact.

Single-sourced and unconfirmed: the victim claim itself rests on the actor's own leak-site post, relayed by ransomware.live. The credential counts rest on the Hudson Rock panel embedded in that same page. Neither has independent corroboration in the material provided. The actor "thegentlemen" has no MITRE ATT&CK profile in our reference data, so no TTP mapping, no tooling attribution and no confidence statement about the group's capability can be made.

Context from the actor's other listings in the same period: UOLconsult (BR, website uol-consult.com, described as a Vienna-based management consultancy), Premier Fiduciary (GB, corporate and fiduciary services for private wealth, family offices and investment managers, with offices in Singapore and Hong Kong), Gallant (FI, advisory and accounting), BDO Greece (GR, accounting, tax and advisory, 50 to 200 staff), CRASL (GB, Suffolk accounting services) and Gfeller Treuhand und Verwaltungs (CH, Dübendorf real estate and fiduciary). The pattern is small and mid-sized professional services firms in the audit, accounting, tax and fiduciary segment, with two larger names (Deloitte, BDO Greece) in the same window. That pattern is an observation about victim selection, not a statement about intrusion technique.

4. Mitigation & containment

P1, within 24 hours:

If your firm holds a Deloitte engagement covering audit, assurance, advisory or managed security functions, contact the engagement partner directly and ask for a written statement of whether any client data or client-facing systems are in scope of the listing. Do not treat the leak-site entry as confirmation and do not treat its absence of published data as an all-clear.
Search your own authentication logs for successful logins to your tenant from Deloitte-associated accounts or third-party contractor accounts in the last 30 days. The 1,134 third-party credential figure is the one that touches you; the employee and user counts are Deloitte's problem to scope.
Force password resets and revoke active sessions for any account, internal or third-party, that authenticates to your environment and is administered by an affected provider. Where those accounts are federated, revoke the trust or require re-consent rather than resetting passwords alone.
Check for session cookie theft against any provider account with privileged access. The panel reports 1,179 critical cookies; stolen session cookies bypass password resets entirely, so a reset without session revocation leaves the access path open.

P2, within 72 hours:

Review your register of information and confirm which Deloitte entities are recorded as ICT third-party service providers, with the contractual entity name and jurisdiction. The listing names the US entity; your contract may sit with a different legal entity in the network.
Pull the subcontracting chain for any Deloitte engagement that touches regulated data. DORA Art. 30 key contractual provisions should already give you the subcontractor list; if it does not, that gap is the finding.
Re-run your concentration analysis across audit, tax and fund-administration providers. If the same upstream firm or the same subcontractor appears in more than one of your critical functions, record it.

P3, within 7 days:

Require phishing-resistant MFA on every third-party and contractor account with access to production, payment or client-data systems. Password-only or push-based MFA does not stop session cookie replay.
Add the provider's domains to your third-party breach monitoring and set an alert threshold for credential-dump mentions, not just for confirmed breach notifications.
Table a standing question for your next third-party risk committee: what is our contractual notification timeline if a provider appears on a leak site but has not confirmed an incident? Most contracts are silent on that scenario.

No vendor fix, patch or version pin applies to this item. There is no CVE and no affected product named in the source.

5. Indicators of compromise

No atomic indicators are present in the source material. There are no hashes, no domains beyond the victim's own legitimate corporate domain, no IP addresses, no file paths and no malware artefacts. The only network-observable data in the listing is the victim's own DNS and mail infrastructure, which is not an indicator of compromise and should not be blocked.

Behavioural indicators:

behaviour	where to observe	confidence
Credential-stuffing or password-spray attempts against accounts associated with the named provider	Identity provider sign-in logs, VPN authentication logs	Low; inferred from the credential-exposure claim, not observed
Session cookie replay from an unfamiliar ASN or device fingerprint	Identity provider session logs, conditional access logs	Low; inferred from the reported critical cookie count
Third-party contractor account authenticating outside its normal geography or hours	Identity provider logs, PAM session records	Low; inferred from the third-party credential count

The credential counts themselves (615 employees, 10,808 users, 1,134 third-party credentials, 300,093 passwords, 22,773 cookies, external attack surface 200) are single-sourced to the Hudson Rock panel on the ransomware.live page. Verify before enforcement.

6. Detection

Insufficient indicators to author detection rules.

The source material contains no distinctive strings, command-line flags, mutex names, scheduled-task names, service names, file paths, registry keys or ransom-note text. The only strings available are the victim's own corporate domain and its legitimate DNS records, which are not threat artefacts and would produce rules that detect the victim rather than the actor.

7. Sources

ransomware.live, "Ransomware: thegentlemen named Deloitte (US)", https://www.ransomware.live/id/RGVsb2l0dGVAdGhlZ2VudGxlbWVu, published 2026-10-09
ransomware.live, "Ransomware: thegentlemen named UOLconsult (BR)", https://www.ransomware.live/id/VU9MY29uc3VsdEB0aGVnZW50bGVtZW4=
ransomware.live, "Ransomware: thegentlemen named Premier Fiduciary (GB)", https://www.ransomware.live/id/UHJlbWllciBGaWR1Y2lhcnlAdGhlZ2VudGxlbWVu
ransomware.live, "Ransomware: thegentlemen named Gallant (FI)", https://www.ransomware.live/id/R2FsbGFudEB0aGVnZW50bGVtZW4=
ransomware.live, "Ransomware: thegentlemen named BDO Greece (GR)", https://www.ransomware.live/id/QkRPIEdyZWVjZUB0aGVnZW50bGVtZW4=
ransomware.live, "Ransomware: thegentlemen named CRASL (GB)", https://www.ransomware.live/id/Q1JBU0xAdGhlZ2VudGxlbWVu
ransomware.live, "Ransomware: thegentlemen named Gfeller Treuhand und Verwaltungs (CH)", https://www.ransomware.live/id/R2ZlbGxlciBUcmV1aGFuZCB1bmQgVmVyd2FsdHVuZ3NAdGhlZ2VudGxlbWVu

8. Adverse Trace position

We assess this as a low-confidence, unconfirmed victim claim with a credential-exposure panel attached, not a confirmed intrusion. The actor has no MITRE ATT&CK profile in our reference data, so we cannot state its tradecraft, tooling or capability, and the victim claim is single-sourced to the actor's own leak-site post. The credential counts are single-sourced to the Hudson Rock panel on that same page and should be verified with the provider before any client acts on them. The material risk to EMEA financial services clients is supply chain: Deloitte and the other named firms sit in the audit, assurance, tax and fiduciary layer that regulated entities depend on, and the third-party credential figure is the part of this listing that touches client environments. We will monitor the listing for the "Data info" publication and for any sample release, watch for corroboration of the credential counts from a second source, and re-issue this advisory if the actor publishes data or if a second independent source confirms the victim claim. Clients who hold a Deloitte engagement touching regulated data should treat the P1 actions in section 4 as due now, not on confirmation.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.