El IBR Listed by thegentlemen Ransomware Group

On February 24, 2026, the ransomware group known as thegentlemen listed the Instituto de Biología Molecular y Celular de Rosario (IBR-CONICET) on its leak site, claiming that internal files had been exfiltrated from the Argentine research institute.

What's Publicly Reported from Reporting

Public reporting indicates the incident stems from a ransomware attack on ibr-conicet.gov.ar. The group posted details referencing the institute’s ZoomInfo profile and stated that internal files were taken. IBR is a prominent Argentine research center with more than 240 professionals focused on microbiology, biomedicine, structural biology, and agrobiotechnology. It supports global researchers, companies, and organizations with advanced infrastructure and promotes technology transfer, innovation through researcher-led startups, and doctoral and postdoctoral training.

At the time of listing, the exact number of affected individuals remained unknown. No specific samples of the stolen data have been publicly detailed beyond the claim of internal files exfiltrated. The listing appeared on the group’s onion site, which is tracked by ransomware monitoring services such as ransomware.live.

Why This Matters for You and Your Family

When a respected research institute suffers a breach, the information inside can easily include details that touch ordinary people. Employees, research partners, students, contractors, and even family members connected to staff may have personal data stored in shared drives, grant applications, travel records, or HR files. Once that material leaves the organization’s control, it can surface in unexpected places.

Credential leaks from such incidents often cascade far beyond the original victim. A single password reused across work, personal email, and online shopping accounts can give attackers a foothold into your life. For families this risk is multiplied: children’s school records, medical forms, or even gaming logins may share the same email domain or phone number listed in an institutional database.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently contain spreadsheets, email address books, project participant lists, and vendor contacts. Attackers and subsequent buyers can combine these with data from earlier breaches to build detailed profiles. A researcher’s work email might link to a spouse’s phone number, a child’s date of birth, or a home address used for shipping lab equipment. These connections create identity chains that turn one leak into long-term exposure.

Public reporting on similar incidents shows that once data reaches leak sites, it is quickly reposted on multiple forums. What begins as institutional files can become the foundation for targeted phishing, identity theft, or harassment campaigns against staff and their households.

Thegentlemen’s Publicly Known Track Record

Public reporting attributes thegentlemen with emerging in late 2024. The group has claimed responsibility for attacks on a range of organizations, including technology firms, healthcare providers, and educational institutions. Their typical playbook involves gaining initial access through phishing or exploited remote desktop services, followed by extensive exfiltration of sensitive files before encryption. They then demand ransom and, if unpaid, publish samples or full datasets on their leak site to pressure victims. Exact success rates and prior victim counts are difficult to verify independently, but available reporting describes a pattern of opportunistic targeting coupled with public shaming of organizations that refuse to pay.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity so you can see what an attacker could assemble from this breach.
• Rotate any password you used at ibr-conicet.gov.ar or related academic systems and enable two-factor authentication through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure of your information is caught within hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become entry points when credential leaks cascade into doxxing chains.
• Let remediation specialists handle takedown requests across data brokers and suspicious sites while you focus on securing your own accounts.

The incident is a reminder that institutional breaches quickly become personal ones. Taking concrete steps now limits how far stolen data can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information.