Adaptavist Group LTD Listed by thegentlemen Ransomware Group

On March 23, 2026, British software company Adaptavist Group LTD appeared on the leak site of the ransomware group known as thegentlemen. The listing follows a complete infrastructure compromise in which attackers exfiltrated source code, customer records, legal documents, and production secrets. Anyone whose information passed through Adaptavist’s systems—including customers of its ScriptRunner tools—may now face increased risk of identity theft, account takeover, or targeted harassment.

Reported Details of the Breach

Public reporting indicates the attackers gained full access to Adaptavist’s environment. They removed the source code of all products, including ScriptRunner for Jira, Confluence, and Bitbucket, as well as the Salable licensing platform. The group also took 484,220 customer records stored in the company’s HubSpot CRM, an incident that constitutes a GDPR violation given Adaptavist’s European operations.

More than 20,000 legal tickets containing 33,000 documents were allegedly exfiltrated. These include roughly 2,000 NDAs and contracts. In addition, the attackers copied over 3TB of data from Nexus repositories, which contained production secrets, Docker images, and other sensitive materials. The volume and sensitivity of the stolen material suggest the breach could affect thousands of individuals and dozens of large organizations that relied on Adaptavist’s services.

Why This Matters for You and Your Family

When a vendor that serves NASA, Visa, Deutsche Bank, and government agencies is breached, ordinary customers and their families often become collateral damage. Your email address, contact details, or project information may have been stored in Adaptavist’s HubSpot instance or attached to a support ticket. Once that data surfaces on criminal forums, it can be combined with other leaks to build a detailed profile of your household.

Credential leaks like this one cascade into gaming accounts, family email, and personal devices. Children’s usernames or parent-linked gaming profiles can be hijacked and used to harass or dox family members. The breach therefore touches not only corporate users but anyone whose data touched Adaptavist’s systems.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at simple data theft. They publish samples to pressure victims and sell or trade the full archive on underground markets. Once the material reaches multiple hands, attackers can map disparate pieces of information—email addresses, usernames, phone numbers, and contract details—into a single identity chain. This process turns one breach into dozens of follow-on attacks ranging from phishing to SIM-swapping and physical intimidation.

Public reporting attributes these tactics to groups that specialize in long-term extortion rather than one-time ransomware payments. Families are especially vulnerable because children’s gaming accounts frequently reuse credentials or share the same household address, creating an easy bridge from corporate data to personal targets.

Thegentlemen’s Publicly Known Track Record

Public reporting attributes thegentlemen’s emergence to mid-2024. The group has since listed healthcare providers, software developers, and professional services firms. Its typical playbook begins with initial access through compromised credentials or vulnerable remote desktop services, followed by broad exfiltration of internal repositories, customer databases, and legal files. Thegentlemen then posts evidence on its leak site and demands payment, often giving victims a short deadline before releasing additional batches of data. The group’s focus on software and consulting companies suggests it deliberately targets organizations whose client data can be leveraged for maximum pressure.

What to do

• Run a DoxxScan to map every link between your email addresses, usernames, phone numbers, and real-world identity so you can see exactly what thegentlemen now hold.
• Rotate every password you used at Adaptavist or any connected service, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household—DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same address or reused credentials.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts.

The Adaptavist breach is a reminder that your personal information is only as safe as the vendors you rely on. Taking concrete steps now limits how far attackers can travel down the identity chain created by this incident. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting that process promptly can prevent today’s corporate leak from becoming tomorrow’s family crisis.