Total Auto Business Solutions Listed by thegentlemen Ransomware Group

On July 31, 2026, the ransomware group known as thegentlemen added Total Auto Business Solutions, Inc. (TABS), operator of autorepairsoftware.com, to its public leak site. The company, which provides AutoFluent shop management software to auto repair shops, tire dealers, and fleet operators across the US and Canada, has not publicly confirmed the incident as of this writing. According to the leak-site listing, internal files were exfiltrated during a ransomware attack.

Leak Site Claim Details

The primary disclosure comes exclusively from thegentlemen’s own leak portal, aggregated on ransomware.live. The listing states that internal files were exfiltrated but does not specify the volume or exact types of data involved. It does not list any affected record count, nor does it name particular categories such as customer databases, payment records, or employee information. The group has set a deadline for publication or further release of the allegedly stolen material, though the precise date is not visible in the public tracker snapshot. Because the claim originates solely from the threat actor’s platform and TABS has issued no official breach notification, regulator filing, or SEC disclosure, this remains an unconfirmed claim.

Why This Matters for You and Your Family

If you or your family members have used services at an auto repair shop, tire dealer, or fleet operator that runs AutoFluent software, your personal information may be among the records the group claims to hold. Repair shops routinely collect names, addresses, phone numbers, email addresses, vehicle identification numbers, license plate data, payment details, and sometimes driver’s license copies. When such operational data is taken, the exposure can reach far beyond the shop itself to every customer the business has served. Even though the exact number of affected individuals is unknown, the nature of the software means thousands of customer records across multiple states could be at risk.

Doxxing and Identity-Chain Risks

Ransomware actors increasingly use stolen internal files not just for immediate extortion but to map identity chains. A single customer record containing an email address, phone number, and vehicle details can be cross-referenced with other breaches to link gaming usernames, social media handles, children’s accounts, and home addresses. This creates persistent doxxing vectors that can lead to targeted phishing, SIM-swapping, or harassment. Credential material or customer logins found in the files could also allow attackers to attempt account takeovers on unrelated services where the same passwords were reused. Public reporting on similar incidents shows these chains frequently expose family members, including minors whose gaming accounts become secondary targets once a parent’s email is confirmed.

thegentlemen Group Track Record

Public reporting attributes thegentlemen as a relatively new double-extortion ransomware operation that emerged in late 2024. The group is known for targeting mid-sized businesses in the services and software sectors, with prior claims against companies in healthcare, logistics, and specialized vertical software. Their typical playbook involves initial access through compromised remote desktop credentials or phishing, followed by exfiltration of sensitive files before deploying ransomware. They then leverage both the threat of data publication on their leak site and the operational disruption of encrypted systems to pressure victims. Like many contemporary ransomware actors, they do not always wait for non-payment before beginning selective data dumps, increasing the likelihood that customer information could surface regardless of any private negotiation.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, vehicle records, and online handles that may have been exposed in this or similar incidents.
• Rotate any password you have used with an auto repair shop running AutoFluent software and enable 2FA using an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 15.4 billion+ breach records and 100+ platforms so the next leak exposing you or your family is detected within hours rather than months.
• Cover your entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same breached customer records.
• Let DoxxScan remediation specialists manage takedown requests and data broker suppression for you instead of attempting manual removal across dozens of sites.

The incident underscores how even specialized business software providers can become gateways to widespread customer exposure. Staying ahead of these cascading risks requires more than reactive password changes. Try DoxxScan for its continuous monitoring across 15.4B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children’s gaming accounts. Its approach is particularly effective against credential leaks that cascade into account takeovers and doxxing chains.