> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # thegentlemen lists Spanish IT firm I-Mas on leak site - URL: https://f4n6.co.uk/security-feed/thegentlemen-lists-spanish-it-firm-i-mas-on-leak-site/ - Published: 2026-11-12T17:28:37.000Z - Updated: 2026-11-12T17:28:37.000Z - Author: Jeff Davies - Tags: #security-feed, thegentlemen ## 1\. Executive summary On 2026-11-12 the extortion group calling itself thegentlemen posted I-Mas Informatica S.L. (imas.es), a Spanish IT services company based in Sabadell, Barcelona, to its leak site. The listing is the operator's own claim: no source confirms that data was taken, that the company's systems were encrypted, or that the victim has acknowledged the incident. Ransomware.live's index page for the entry records one compromised employee, four third-party employee credentials and an external attack surface of three, figures that are not explained in the source and should be treated as unverified. I-Mas is not a financial services firm, but it sells managed IT, ERP implementation (SAP, Odoo, Microsoft Dynamics) and cloud services (AWS, Azure) to SMEs, industrial companies and public sector clients in Catalonia and Spain, so any real compromise of its systems or its client-facing service accounts is a supply-chain exposure for those clients. For EMEA financial services the direct risk is low unless a client uses I-Mas as an ICT third-party provider, in which case the exposure is that provider's access to the client's systems and data. No CVE is associated with this item and no exploitation of a specific vulnerability is reported. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. ## 3\. Technical analysis & attack chain The listing establishes one thing: thegentlemen claims I-Mas as a victim and has published the company name, country (ES) and website (imas.es) on its leak site. It does not establish the initial access vector, the date of intrusion, whether data was exfiltrated, whether systems were encrypted, the volume or nature of any data taken, or any demand. No source in this item reports a ransom amount, a count of records, or a deadline. The victim has not confirmed the incident in any source reviewed. The index page adds three figures without explaining how they were derived: one compromised employee, four third-party employee credentials and an external attack surface of three. These are Ransomware.live's own enrichment fields, single-sourced, and the source does not state whether they reflect infostealer log hits, breach-corpus matches or something else. They should not be read as confirmed initial-access paths. If they are accurate, stolen employee credentials and third-party credentials are a plausible route into a managed service provider, but that is an assessment, not a finding. What the victim profile tells a defender is where the exposure would sit if the claim is true. I-Mas runs custom software development, cloud migration, ERP implementation and managed IT services across SAP, Odoo, Microsoft Dynamics, AWS and Azure, plus network management and VoIP telephony. A managed service provider of that shape holds administrative access into client environments and stores client source code, configuration and business data. The sectors named in the profile (manufacturing, retail, healthcare, education, logistics, public sector) are the client base, not financial services. No malware family, tooling, command-and-control infrastructure, persistence mechanism or exfiltration channel is named in any source for this event. No indicators are available. The attribution to thegentlemen rests on the operator's own leak-site post; the group has no MITRE ATT&CK profile in the reference data, so the attribution is unconfirmed and no technique mapping is offered. ## 4\. Mitigation & containment P1 (within 24h): if your organisation uses I-Mas as an ICT third-party provider, contact your account manager and ask directly whether the company has suffered a security incident, whether client data or client credentials were exposed, and what its incident response status is. Do not wait for a public statement. In parallel, review which of your own credentials, API keys, VPN accounts or administrative sessions I-Mas personnel or systems hold, and list them. P1 (within 24h): rotate any credential, API key, service-account secret or VPN account that I-Mas staff or I-Mas-managed systems can use to reach your environment, and revoke sessions tied to those accounts. Check authentication logs for those accounts for anomalous source addresses or off-hours access over the past 30 days. P2 (within 72h): if I-Mas holds remote-access or RMM tooling into your estate, restrict it to named source addresses and require MFA on every session. Review the third-party access clause in the contract against DORA Art. 30 obligations if I-Mas is a contracted ICT provider. P3 (within 7 days): add imas.es and the I-Mas corporate identity to threat-intelligence watchlists so that any further leak-site activity or credential dump is picked up. Brief procurement and vendor-management staff that a leak-site listing is an unconfirmed operator claim and should trigger verification, not automatic termination. No fixed release, patch or vendor advisory is named in public reporting for this item, because no vulnerability is identified. There is nothing to patch on the basis of this listing alone. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The only network value in the sources is the victim's own website, imas\[.\]es, which is a legitimate business domain and not an indicator. The enrichment counts on the Ransomware.live page (one compromised employee, four third-party employee credentials, external attack surface of three) are not atomic indicators and carry no values to pivot on. ## 6\. Detection Insufficient indicators to author detection rules. ## 7\. Sources - Ransomware.live, "Ransomware: thegentlemen named imas (ES)", https://www.ransomware.live/id/aW1hc0B0aGVnZW50bGVtZW4=, published 2026-11-12. - Ransomware.live, "Victim: imas – thegentlemen", https://www.ransomware.live/id/aW1hc0B0aGVnZW50bGVtZW4= (index page with enrichment fields; no publication date stated). ## 8\. Adverse Trace position Adverse Trace assesses this as a low-severity item for EMEA financial services clients. The listing is a single-source operator claim with no confirmed data theft, no confirmed encryption, no named vulnerability and no indicators; the victim is an IT services company, not a financial institution, and no source links it to financial services clients. The severity rises to moderate for any client that uses I-Mas as an ICT third-party provider, because a managed service provider with administrative access is a supply-chain path regardless of whether this particular claim is true. We will monitor thegentlemen's leak site for a data dump, a deadline or a victim statement from I-Mas, and will reissue this advisory if either appears. Clients who confirm an I-Mas dependency should treat the P1 credential-rotation step as the priority action and report back so we can track exposure across the client base. --- [Read the original source →](https://www.ransomware.live/id/aW1hc0B0aGVnZW50bGVtZW4=?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*