Ransomware: thegentlemen named Westrop Primary & Nursery School (GB)

1. Executive summary

A ransomware group calling itself "thegentlemen" listed Westrop Primary & Nursery School, a state-funded community school in Highworth, Swindon (Wiltshire, GB), on its public leak site on 2026-10-03. The listing is indexed by ransomware.live and names the school's domain, westropprimaryschool.co.uk; no data samples, ransom demand, or negotiation status are visible in the indexed material. The victim is a ~380-pupil primary school with roughly 47 staff and an annual income near £2 million, not a financial services firm, so the direct exposure to Adverse Trace clients is indirect. The risk to EMEA financial services is third-party and supply-chain: schools sit inside local-authority, payroll, pension, insurance, and managed-IT chains that also serve regulated firms, and a listing of this kind is a prompt to check whether any shared service provider appears in the same actor's victim set. Attribution to "thegentlemen" rests on the leak-site self-identification alone; the actor has no MITRE ATT&CK profile in our reference data, so the attribution is unconfirmed.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The victim is a UK primary school, not a financial entity, and the source material contains no fact that changes a client's obligations under the articles in our reference. The one indirect hook is third-party concentration: if a client's ICT provider also serves the education or local-authority sector and appears in the same actor's victim set, DORA Art. 29 (preliminary assessment of ICT concentration risk) becomes relevant to that provider relationship. That test is not met on the facts here, so we do not assert it.

3. Technical analysis & attack chain

The source material does not describe an attack chain. Ransomware.live indexes the leak-site post and the victim's DNS records; it does not publish the intrusion vector, the malware family, the encryption routine, or any exfiltration evidence. What follows is limited to what the listing actually states, with the gaps named rather than filled.

Confirmed from the listing:

1. The actor "thegentlemen" published a victim entry naming Westrop Primary & Nursery School on 2026-10-03 at 06:25 UTC.
2. The entry records the victim country as GB and the website as westropprimaryschool.co.uk.
3. The listing is a leak-site post. Ransomware.live states it indexes only publicly visible operator posts and open web sources and does not access or host the underlying stolen content.

Not stated in the source, and therefore not asserted here: initial access vector, exploited CVE or component, malware family or binary names, persistence mechanism, privilege escalation, command-and-control infrastructure, lateral movement, volume or nature of any data taken, ransom amount, and whether any data was in fact exfiltrated. The listing's presence on a leak site is consistent with the actor claiming data theft, but the source does not show a data sample, so we do not characterise this as confirmed exfiltration.

The victim profile in the source is background, not intrusion detail: a state-funded community school founded in 1969, roughly 380 enrolled pupils against a capacity of 495, 18.6% on free school meals, 16.3% on SEN support, about 47 staff (15 teachers, 32 teaching assistants), headteacher Cindy Acres since 2018, annual income near £2 million with a reported £75K surplus and about £100K reserves, rated "Good" by Ofsted in October 2022. None of this bears on the intrusion method.

Confidence caveat: the entire item is single-sourced to the ransomware.live index of the actor's own post. The actor's claim is self-reported and unverified. We have no independent confirmation that data was taken, that systems were encrypted, or that the actor's identity is stable. Treat the attribution to "thegentlemen" as unconfirmed: the actor has no MITRE ATT&CK profile in our reference data, so no TTP mapping can be made from it.

4. Mitigation & containment

The source gives no vendor fix, no CVE, and no technical indicator, so mitigation here is process and third-party hygiene rather than patch guidance. The steps below are framed for a financial services client whose exposure is indirect.

P1 (within 24h)

• Search your third-party and vendor inventory for any provider that also serves Westrop Primary & Nursery School, Swindon Borough Council, or the Wiltshire education estate, and for any provider that appears elsewhere in the "thegentlemen" victim set. If a shared provider is found, request written confirmation of whether it was affected and what data of yours it holds.
• If you hold any data on the school (donations, sponsorship, payroll for placed staff, insurance), confirm with the school or its local authority whether your data was in scope before you make any external statement.

P2 (within 72h)

• Re-check your incident-reporting decision tree against DORA Art. 17 and Art. 18 for any ICT-related incident at a provider that supports a critical or important function, so the classification step is ready if a shared provider confirms impact.
• Confirm your contract with any affected provider carries the DORA Art. 30 provisions on incident assistance and cooperation, and that you can obtain a forensic report if needed.

P3 (within 7 days)

• Add the actor name "thegentlemen" to your threat-intel watchlist and re-run the victim-set match monthly. The actor has no ATT&CK profile, so watchlist matching is name-based only and will miss rebranding.
• Review whether any education-sector or local-authority supplier sits in your ICT concentration map under DORA Art. 29, and record the outcome even if the answer is "no material concentration".

5. Indicators of compromise

No indicators of compromise available in the source material. The listing provides a victim domain (westropprimaryschool.co.uk) and a leak-site URL, neither of which is an indicator of the intrusion; the victim domain is the school's own legitimate site and is not malicious infrastructure. We do not emit it as an IOC.

No behavioural indicators are described in the source either: there is no authentication pattern, device registration, process activity, or network traffic detail to observe.

6. Detection

Insufficient indicators to author detection rules. The source contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text, or hard-coded values from the threat itself. The only strings present are the actor name, the victim name, and the victim's legitimate domain, none of which are artefacts of the intrusion. Authoring a rule on those would detect reporting about the event, not the event.

7. Sources

• ransomware.live, "Victim: Westrop Primary & Nursery School – thegentlemen", https://www.ransomware.live/id/V2VzdHJvcCBQcmltYXJ5ICYgTnVyc2VyeSBTY2hvb2xAdGhlZ2VudGxlbWVu, published 2026-10-03.

8. Adverse Trace position

Adverse Trace assesses this as a low direct-severity item for EMEA financial services clients and a moderate third-party hygiene prompt. The victim is a UK primary school, the source is a single leak-site index with no technical detail, and the attribution to "thegentlemen" is unconfirmed because the actor has no MITRE ATT&CK profile in our reference data. We are not raising a client-facing alert on the school itself. We will monitor the "thegentlemen" victim set for any entry that names a provider in our clients' ICT supply chains, and we will re-issue this advisory if a shared provider is identified or if the actor publishes data samples that change the confidence level. Clients who believe they share a provider with this victim should contact their Adverse Trace analyst to run the match against their vendor inventory.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.