Tooltec Listed by thegentlemen Ransomware Group

On July 16, 2026, Swedish precision machining firm Tooltec AB appeared on the leak site operated by the ransomware group known as thegentlemen. The listing states that internal files were exfiltrated during a ransomware attack on the company, which is based in Trollhättan and supplies complex components to the automotive, energy, aeronautical, and aerospace sectors. Anyone whose personal or employment data resides in those files now faces the possibility that their information has been published or is being held for extortion.

Reported Details from the Listing

The primary disclosure on the thegentlemen leak site, archived via ransomware.live, indicates that Tooltec suffered a ransomware incident in which internal files were successfully exfiltrated. The listing does not quantify the number of records affected, does not specify the exact data types beyond “internal files,” and does not disclose any ransom demand or payment deadline. Tooltec has not yet issued a public breach notification detailing the scope, so the precise volume and sensitivity of the stolen material remains unknown to the public.

thegentlemen typically posts samples or proof of data on their leak portal after initial extortion attempts. The presence of Tooltec on the site as of mid-July 2026 confirms that negotiations either failed or were never concluded to the group’s satisfaction.

Why This Matters for You and Your Family

If you or a family member works at Tooltec, has done business with the company, or appears in its supplier, customer, or HR records, your information may now sit in an attacker-controlled archive. Even basic employee details such as names, work emails, phone numbers, or payroll references can be combined with other leaks to build a complete profile. For families, this risk extends beyond the individual employee: spouses, children listed as emergency contacts, or dependents on company benefits can be pulled into the same chain of exposure.

The manufacturing sector often stores a surprising amount of personal data—NDAs, travel records, security clearances for aerospace work, or even family addresses for background checks. Once exfiltrated, that material does not disappear when the news cycle moves on.

Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at posting generic “internal files.” They frequently comb stolen data for any personally identifiable information that can be sold or used to pressure victims further. A leaked work email can be matched to personal accounts, revealing gaming usernames, social-media handles, or children’s online profiles. These linkages create doxxing chains that turn a corporate breach into targeted harassment or identity theft against you and your household.

Credential leaks originating from such incidents routinely cascade into account takeovers on gaming platforms, email, and financial services. Children’s gaming accounts tied to a parent’s work email are especially vulnerable because parents often reuse passwords or security questions that reference employment details now circulating among criminals.

thegentlemen’s Known Track Record

Public reporting attributes the emergence of thegentlemen to late 2024. The group has since claimed responsibility for attacks on organizations across Europe and North America, with a focus on mid-sized manufacturing, technology, and professional-services firms. Notable prior victims include several European industrial suppliers whose data appeared on the same leak portal after ransom demands went unmet.

The group’s typical playbook involves initial access through phishing or exploited remote-desktop services, followed by rapid exfiltration of documents before encryption. They then demand payment and, if unpaid, publish proof packages and threaten full data dumps. Their extortion style combines public shaming on the leak site with direct contact to company executives and, in some cases, to affected individuals whose contact details were allegedly stolen.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you ever used at Tooltec or related supplier portals anywhere it has been reused, and switch to 2FA via an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts which often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The Tooltec incident is a reminder that even specialized manufacturers handling aerospace and automotive work can become ransomware targets, placing ordinary employees and their families in the crosshairs. Start your DoxxScan trial today and use its continuous monitoring, AI-powered identity-chain mapping, and hands-on remediation by specialists to regain control over what criminals already hold. DoxxScan is also effective for protecting gaming accounts—yours or your children’s—because credential leaks like this one routinely cascade into account takeovers and doxxing chains.