On March 18, 2026, the ransomware group known as thegentlemen added Excellentiam to its leak site, claiming that it had exfiltrated internal files from the company during a ransomware attack.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Excellentiam
Get alerted the next time Excellentiam files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Excellentiam’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Excellentiam, a business process outsourcing provider based in Colombia, specializes in KYC compliance, identity validation, electronic signatures, document lifecycle management, IT service desk support, and operational outsourcing. Public reporting indicates the attackers gained access to the company’s systems, encrypted data, and then exfiltrated files before publishing a sample on their onion site hosted at tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion. The exact number of people whose records were taken remains unknown. Available reporting describes the exposed material as internal files containing sensitive business and client-related information. No specific deadline for ransom payment has been publicly detailed in the initial listing.
Why This Matters for You and Your Family
When a company that handles Client Knowledge Forms, identity validation, and electronic signatures is breached, the information it processes often includes names, addresses, government identification numbers, contact details, and financial records of ordinary customers. If you or anyone in your family has used services from businesses that outsource their verification or support processes to Excellentiam, your personal data may now sit in an attacker’s archive. Credential leaks like this one frequently cascade into account takeovers on unrelated platforms where the same email and password were reused. Children’s accounts are especially vulnerable because gaming services and educational platforms often rely on the same family email addresses or phone numbers listed in adult records.
The Doxxing and Identity-Chain Implications
Ransomware operators rarely stop at encrypting one company’s files. Once they possess internal spreadsheets or customer databases, they can link an email address to a real name, home address, phone number, and associated online handles. This creates an identity chain that makes doxxing straightforward. A single leaked KYC record can expose your family’s full digital footprint across social media, shopping sites, and gaming platforms. Public reporting shows these chains often lead to harassment, targeted phishing, or extortion attempts against individuals whose data was never meant to leave the vendor’s secure environment.