Executive Coach Listed by thegentlemen Ransomware Group

On June 15, 2026, the ransomware group known as thegentlemen added Executive Coach Inc. to its public leak site, confirming that internal files had been exfiltrated from the Pennsylvania-based charter bus and luxury motorcoach company.

Confirmed Facts from Reporting

Public reporting indicates the company, which has operated since 1979 and provides group transportation, airport transfers, and customized tours across Pennsylvania, Maryland, and surrounding areas, suffered a ransomware incident. The data posted to the leak site consists of internal files exfiltrated during the attack. The exact number of individuals whose information appears in the files remains unknown, and the specific types of records have not been fully detailed in available reporting. The listing appeared on the group’s leak site, which is tracked by ransomware.live at the provided source URL.

Why This Matters for You and Your Family

When a company like Executive Coach Inc. loses control of internal files, the information inside often includes customer names, addresses, phone numbers, email addresses, payment details, or travel itineraries. If you or your family have ever booked a charter bus, airport shuttle, or group tour with them, your personal data may now be in attackers’ hands. These details can be sold, traded, or used to launch further attacks against you. Even if you were not a direct customer, family members, friends, or colleagues who traveled with the company could have exposed records that link back to your household.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently contain more than isolated records. They can include spreadsheets that connect names to addresses, phone numbers to email accounts, and customer IDs to booking histories. Attackers stitch these fragments together to build detailed profiles. A single leaked phone number or email can lead to linked social-media handles, gaming accounts, or school records. Once the chain starts, it becomes easier for criminals to impersonate you, attempt account takeovers, or harass your family online. Credential leaks of this nature regularly cascade into gaming account compromises, especially for children whose usernames and passwords are reused across entertainment platforms and family booking systems.

Thegentlemen’s Publicly Known Track Record

Public reporting attributes thegentlemen’s emergence to relatively recent ransomware activity. The group follows a classic double-extortion playbook: it first gains initial access to a victim’s network, exfiltrates sensitive files, then encrypts systems and demands payment to prevent publication of the stolen data. Notable prior victims have included organizations across varied sectors, though specific earlier targets are still being catalogued by ransomware trackers. The group typically posts samples or full datasets to its leak site when victims do not meet extortion deadlines, aiming to pressure payment through reputational damage and the threat of further data dissemination.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles so you can see exactly what chains back to this incident.
• Rotate any password you have ever used when booking travel or transportation services, especially those reused on email, gaming, or family accounts, and switch to 2FA through an authenticator app.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next exposure of your information is caught and addressed in hours rather than months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often become targets when travel-booking data links real identities to usernames.
• Let remediation specialists handle the time-consuming work of sending takedown requests to data brokers and monitoring platforms where your information surfaces.

The incident underscores that even regional service companies hold data that can fuel larger identity compromises. Taking concrete steps now limits how far attackers can travel down the chain. DoxxScan by GalaxyWarden delivers continuous monitoring across more than 15.4 billion breach records and over 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts alongside adult profiles. Start your DoxxScan trial today to gain clarity and regain control.