ICET Studios Listed by thegentlemen Ransomware Group

On October 14, 2025, Italian production company ICET Studios appeared on the leak site of the ransomware group known as thegentlemen, with the attackers claiming to have exfiltrated internal files from the firm’s networks.

Reported Details of the Incident

Public reporting indicates that thegentlemen posted ICET Studios to their leak site on that date, describing the theft of internal company documents. The company, based in Italy, specializes in scenic construction for film, television, advertising, and live events, employing carpenters, painters, decorators, blacksmiths, electricians, and production managers. No confirmed total of affected individuals has been released, and the precise volume or sensitivity of the stolen files remains unclear from available reporting. The primary source is the group’s own Tor-based leak page, as tracked by ransomware.live.

Why This Matters for You and Your Family

When a company like ICET Studios suffers a ransomware breach, the information stolen can easily include contracts, supplier lists, employee records, or client contacts that contain personal data such as names, addresses, phone numbers, or email accounts. If your employer, your child’s school, a vendor you use, or an event organizer you worked with has done business with ICET Studios, your information or your family’s information may now sit in an attacker’s archive. Once that data leaves a controlled corporate environment, it travels quickly through underground markets and can be combined with other leaks to build a complete picture of your household.

The Doxxing and Identity-Chain Risk

Ransomware groups rarely stop at simple data theft. They exfiltrate files, publish samples as proof, and then demand payment to prevent full release. Even if the company pays or the files are not fully dumped, samples often circulate. A single exposed email or phone number becomes a pivot point. Attackers chain that detail to usernames on social media, gaming platforms, or shopping sites. Before long, a seemingly minor business breach can lead to doxxing attempts, SIM-swapping risks, or targeted phishing aimed at you or your children. Credential leaks of this nature frequently cascade into account takeovers precisely because the same passwords or recovery details appear across work, personal, and gaming logins.

Thegentlemen’s Publicly Known Track Record

Public reporting attributes thegentlemen with emerging in late 2024 as a ransomware operation that combines double-extortion tactics with selective data leaks. The group has listed a range of victims, from small manufacturers to service firms, typically following a playbook of initial access through phishing or exploited remote desktop services, followed by exfiltration of internal documents and deployment of ransomware. They then publish proof packages on their leak site and set payment deadlines, threatening full disclosure if unpaid. Their exact success rate and total victims are still being tracked by independent researchers, but the pattern of using stolen corporate files for leverage is consistent across their listed incidents.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to break those chains.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Rotate any password you used at ICET Studios or any related vendor anywhere it has been reused, and switch on 2FA through an authenticator app instead of text messages.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the weakest link in doxxing chains.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate with threat actors yourself.

The speed with which ransomware data moves from corporate servers to public leak sites shows that waiting for a company to notify you is no longer enough. Taking direct control of your own exposure footprint gives you and your family the earliest possible warning and the clearest path to remediation. DoxxScan by GalaxyWarden delivers exactly that: continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered online handles to real-world identities, and hands-on remediation specialists who manage takedowns for you, all with household coverage that includes children’s gaming accounts vulnerable to the same credential-stuffing attacks seen after incidents like this one.