Thialf Listed by thegentlemen Ransomware Group

On July 23, 2026, Dutch ice arena Thialf appeared on the leak site of the ransomware group known as thegentlemen. The listing states that the world-renowned speed-skating venue in Heerenveen, Netherlands, suffered a ransomware attack in which internal files were exfiltrated. The notification does not disclose the number of people affected or specify which exact records were taken.

Reported Details from the Listing

The primary disclosure on the thegentlemen leak site states that Thialf was hit by a ransomware attack and that attackers successfully exfiltrated internal files. No sample data has been published at the time of writing, and the listing does not quantify the volume or type of documents stolen. The entry simply lists the organization by name and domain, marking it as a confirmed victim. Public records confirm Thialf serves as the Netherlands’ premier long-track speed skating facility and was recently named the venue for the 2030 Winter Olympics long-track events.

Why This Matters for You and Your Family

When a public sports venue like Thialf is breached, the people whose information ends up in the stolen files are ordinary visitors, season-ticket holders, competition participants, employees, suppliers, and local community members. If your name, email, address, phone number, date of birth, payment details, or children’s registration information was ever provided to Thialf, it may now sit in an attacker-controlled archive. Internal files from such organizations routinely contain exactly this kind of personal data. Once exfiltrated, there is no reliable way to know whether or when it will surface on additional criminal marketplaces.

Doxxing and Identity-Chain Risks

Ransomware operators rarely stop at the initial breach. Stolen internal files frequently contain spreadsheets that link names to email addresses, phone numbers, dates of birth, and sometimes passport copies or national ID numbers. These records become the foundation for doxxing chains: attackers or subsequent buyers can correlate the data with gaming usernames, social-media handles, and family relationships. A credential or personal detail exposed in this incident can lead to account takeovers on Steam, Roblox, Discord, or email accounts belonging to you or your children. The risk is not abstract; it is a documented pattern in which one breach cascades into multiple identity-theft and harassment vectors.

thegentlemen’s Known Track Record

Public reporting attributes thegentlemen as a ransomware and extortion operation that emerged in late 2024. The group typically gains initial access through phishing or exploitation of remote desktop services, exfiltrates data before deploying ransomware, and then runs a double-extortion campaign: demanding payment to prevent file decryption and to stop publication of the stolen documents. Notable prior victims include mid-sized organizations across Europe and North America, many in the hospitality, manufacturing, and public-event sectors. The group maintains its own leak site and has shown willingness to publish sensitive internal files when ransom demands are ignored. As with most ransomware actors, the exact success rate and average ransom payment remain unknown, but their public listings serve as both shaming tactic and advertisement to other criminals.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you ever used on Thialf.nl or associated systems anywhere it has been reused, and switch to 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours instead of months.
• Cover the entire household — DoxxScan family coverage includes dependents and children’s gaming accounts that often chain back to the same leaked address or parent email.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that would otherwise require dozens of manual submissions.

The Thialf breach is a reminder that even organizations you trust with limited information can become gateways to broader identity exposure. Taking concrete steps now limits how far attackers can travel down the chain that begins with this incident. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with full household coverage that explicitly protects children’s gaming accounts from cascading takeovers.