Disney Family Listed by thegentlemen Ransomware Group

On July 23, 2026, the ransomware group known as thegentlemen added Disney Family (also referred to as Shamrock Holdings) to its public leak site, confirming that it had exfiltrated more than 800 GB of internal files dating from the 1980s through June 2026. The listing targets the private investment firm and family office founded by Roy E. Disney to manage the wealth of the Disney family branch, not the Walt Disney Company itself. The disclosure indicates that highly sensitive documents spanning 14 categories were taken, including family trusts, tax administration records, and private equity fund management materials. Affected individuals include prominent family members such as Abigail Disney, Roy P. Disney, and Stanley Gold.

Reported Details from the Leak Site

The primary disclosure on thegentlemen’s leak page, archived via ransomware.live, states that internal files were exfiltrated during a ransomware incident. The listing does not publicly detail the exact number of individuals affected, nor does it itemize every file type beyond referencing the 14 critical categories and the 800 GB volume. It does confirm the data spans nearly four decades and includes information tied directly to the family’s private financial and investment operations. The group has not yet published sample files in the initial listing, which is common before escalation deadlines.

Why This Matters for You and Your Family

Even though this breach centers on a prominent family office, the precedent it sets is relevant to any household whose financial, tax, or trust records could be exposed. When high-profile families experience this scale of compromise, it normalizes the public release of private wealth documents that can be used for identity theft, fraudulent loan applications, or targeted phishing against anyone whose data shares similar structures. Family trusts, tax records, and investment documents are among the most valuable assets for criminals because they contain permanent identifiers, account numbers, and relationship mappings that do not expire.

Doxxing and Identity-Chain Risks

The exposure of trusts, tax administration files, and private equity details creates long-term doxxing chains. A single leaked address, phone number, or email can link multiple online handles, family member names, and children’s records. These connections often extend into gaming accounts, where credential reuse allows attackers to pivot from financial data to social engineering and further public exposure. Once such chains are built, they are sold and reused across criminal networks for years. Credential leaks like this one cascade into account takeovers that can affect not only the primary victims but also relatives and dependents whose information appears in the same documents.

TheGentlemen’s Known Track Record

Public reporting attributes thegentlemen as a ransomware and extortion operation that emerged in late 2024. The group is known for targeting organizations with significant financial or personal data stores, including family offices and investment entities. Their typical playbook involves initial access through phishing or exploited remote services, followed by extensive exfiltration before encryption. They favor prolonged extortion over immediate ransomware deployment, using leak sites to pressure victims by threatening to publish sensitive personal and financial records. Prior victims have included entities whose data overlaps with high-net-worth individuals, consistent with the current Disney Family listing.

What to do

• Run a DoxxScan to map every link between your emails, phones, family names, and real-world identity, including no-subscription cleanup of exposed records.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Rotate any passwords used at Shamrock Holdings, Disney Family-related services, or any financial platforms where the same credentials are reused, and switch to 2FA via an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family coverage, which extends protection to dependents and children’s gaming accounts that frequently chain back to the same addresses and identities leaked in incidents like this.
• Let remediation specialists handle takedown requests for any personal documents or financial details that surface on data broker sites or underground forums.

The compromise of nearly four decades of family office records shows that private financial histories remain attractive targets long after they are created. Protecting yourself and your family requires more than reactive checks. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4 billion breach records and over 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with full household coverage that includes children’s gaming accounts vulnerable to credential-based attacks. Acting early limits how far attackers can travel down the identity chains this breach has made available.