Excellentiam Listed by The Gentlemen Ransomware Group

On March 18, 2026, the ransomware group known as thegentlemen added Excellentiam to its leak site, claiming that it had exfiltrated internal files from the company during a ransomware attack.

What Public Reporting Shows

Excellentiam, a business process outsourcing provider based in Colombia, specializes in KYC compliance, identity validation, electronic signatures, document lifecycle management, IT service desk support, and operational outsourcing. Public reporting indicates the attackers gained access to the company’s systems, encrypted data, and then exfiltrated files before publishing a sample on their onion site hosted at tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion. The exact number of people whose records were taken remains unknown. Available reporting describes the exposed material as internal files containing sensitive business and client-related information. No specific deadline for ransom payment has been publicly detailed in the initial listing.

Why This Matters for You and Your Family

When a company that handles Client Knowledge Forms, identity validation, and electronic signatures is breached, the information it processes often includes names, addresses, government identification numbers, contact details, and financial records of ordinary customers. If you or anyone in your family has used services from businesses that outsource their verification or support processes to Excellentiam, your personal data may now sit in an attacker’s archive. Credential leaks like this one frequently cascade into account takeovers on unrelated platforms where the same email and password were reused. Children’s accounts are especially vulnerable because gaming services and educational platforms often rely on the same family email addresses or phone numbers listed in adult records.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at encrypting one company’s files. Once they possess internal spreadsheets or customer databases, they can link an email address to a real name, home address, phone number, and associated online handles. This creates an identity chain that makes doxxing straightforward. A single leaked KYC record can expose your family’s full digital footprint across social media, shopping sites, and gaming platforms. Public reporting shows these chains often lead to harassment, targeted phishing, or extortion attempts against individuals whose data was never meant to leave the vendor’s secure environment.

Thegentlemen’s Publicly Known Track Record

Public reporting attributes thegentlemen with emerging in late 2024 as a double-extortion ransomware operation. The group is known for targeting mid-sized service providers and technology vendors, with prior victims including other BPO and data-processing firms. Their typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by lateral movement to locate valuable client databases. After exfiltration they deploy ransomware, then list the victim on their leak site with samples if payment is not received. Extortion style combines threats of data publication with offers to negotiate deletion in exchange for cryptocurrency payment.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you used at Excellentiam or any vendor it supported, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same family address or email.
• Let the remediation specialists perform hands-on takedown requests across data brokers and leak sites on your behalf.

The incident underscores that even companies you never directly hired can expose your family’s most sensitive details. Starting protective steps now limits how far attackers can travel down the identity chain created by this claimed breach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Source: thegentlemen leak site (via ransomware.live)