Nostrum Listed by thegentlemen Ransomware Group

On April 19, 2026, Japanese technology firm Nostrum Corporation appeared on the leak site of the ransomware group known as thegentlemen. The company, which develops smartphone apps, web systems, and employment aptitude testing platforms used by major employers, is claimed to have had internal files exfiltrated following a ransomware attack.

Reported Details of the Incident

Public reporting indicates that Nostrum, founded in 1991 and based in Japan, was listed by thegentlemen on their leak portal. The exposed material consists of internal files taken during the ransomware operation. No confirmed victim count has been released, and the precise volume or sensitivity of the stolen data remains unclear from available reporting. The company specializes in simulation tools that replicate real-world employment exams such as SPI and TG-WEB.

Why This Matters for You and Your Family

When a company like Nostrum suffers a breach, the information inside its systems can include resumes, contact details, test results, and personal identifiers belonging to ordinary job seekers and their families. Internal files from an employment testing platform often contain names, addresses, email addresses, phone numbers, dates of birth, and sometimes employment history. Once that data leaves the company’s control, it can be sold, traded, or used to target you with phishing, identity theft, or harassment. Your family’s information may be linked to these records if anyone in the household has used the platform for job applications.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently serve as the starting point for larger doxxing campaigns. A single email or phone number can be correlated with gaming usernames, social media handles, and family addresses. This creates an identity chain that lets attackers move from one account to another. Credential leaks of this nature regularly cascade into gaming account takeovers, especially when the same password has been reused across work-related services and personal or children’s gaming platforms. Available reporting describes how such chains allow threat actors to publish personal details, harass family members, or demand payment to stop further exposure.

Thegentlemen’s Known Track Record

Public reporting attributes the group’s emergence to 2024. Thegentlemen has targeted organizations across multiple countries, focusing on companies with valuable internal data. Their typical playbook involves gaining initial access, exfiltrating sensitive files, and then publishing samples on their leak site while demanding ransom. If payment is not made by their deadline, they release additional data in batches. The group’s operations emphasize extortion through public exposure rather than solely encryption.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach may have exposed.
• Rotate any password you used on Nostrum’s systems or related job portals anywhere else it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your information is caught and addressed in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become targets when credential leaks create doxxing chains.
• Let remediation specialists handle takedown requests for any exposed personal records that appear on data broker sites or underground forums.

The incident underscores that even mid-sized technology vendors handling everyday personal information can become gateways to broader identity compromise. Taking deliberate steps now limits how far attackers can travel along the identity chain created by this and future breaches. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.