The Gentlemen Ransomware Group Claims to Have Leaked 1.2 TB of Pertamina Data
Shocking news has emerged from the national cybersecurity scene after the ransomware group The Gentlemen claimed to have breached Pertamina’s systems and stolen approximately 1.2 terabytes of data. This claim was first recorded on the ransomware monitoring platform, ransomware.live, on Friday, July 31, 2026, with the attack estimated to have occurred on the same date. In a statement published on their leak site, the group stated that it had obtained various types of data, ranging from NDAs, human resources data, user data, employee data, technical drawings, design models, bank accounting records, legal and tax documents, to SCADA documents related to energy operational systems.
In addition, the perpetrators also claimed to have obtained confidential company files, work documentation photos, internal screenshots, and various other files, totaling more than 1.2 TB—equivalent to 1,200 GB. As of this article’s publication, Pertamina has not issued an official statement regarding the veracity or scope of the impact of these claims. As is typical with claims published on ransomware groups’ leak sites, the full validity of the claimed data volume and content can only be confirmed through an independent forensic investigation.
Brief Profile of The Gentlemen Group
The Gentlemen is a ransomware group operating under a “ransomware-as-a-service” model and was first observed to be active in mid-2025. This group is known for employing a “double extortion” approach, in which it first steals the victim’s data before encrypting the entire infrastructure, then threatens to publish that data if the ransom is not paid. Unlike ransomware groups that launch massive, untargeted attacks, The Gentlemen are known to be more selective in choosing their victims—typically large companies with complex network structures that have the potential to yield high ransom payments.
This group made headlines in early May 2026 when their own internal communications infrastructure was breached and their data was leaked to the public, revealing a list of victims and their operational methods in greater detail. Despite experiencing an internal data breach, the group has continued its extortion activities against new victims, with Pertamina being one of the entities appearing on their latest list of claims.
Risks to the National Energy Sector
As a state-owned energy company with operations spanning upstream, downstream, gas, and renewable energy, Pertamina holds highly sensitive data from both an operational and national security perspective. If these claims of a data breach are true, the potential impact extends beyond financial or reputational losses to include risks to the operational continuity of the energy infrastructure that serves as the backbone of the national economy. Documents such as SCADA, for example, are directly related to automated control systems at energy production and distribution facilities, so a leak of this type of document requires extra attention from the industrial cybersecurity perspective.
Incidents like this also serve as a reminder to large-scale companies that modern ransomware threats are no longer limited to locking access to systems but also target large-scale data theft as an additional means of pressure. The more types of data that are successfully obtained, the greater the leverage the perpetrators have in negotiations or in threatening to release the data to the public.
Steps Typically Required Following a Data Breach Claim
When an organization faces a data breach claim from a ransomware group, the first step is typically to conduct a thorough forensic investigation to verify the validity of the claim, including tracing the entry point exploited by the attackers and determining the extent to which internal systems have been compromised. Additionally, auditing all administrator access and system credentials is a critical step to ensure no additional vulnerabilities remain open to the attackers or other parties who might exploit the situation.
On the other hand, managing the digital footprint and public discourse is equally important, given that such claims can spread rapidly across various platforms and search engines. A swift and transparent response from the relevant parties, accompanied by appropriate technical measures, will be crucial in determining the long-term impact of this incident on public trust and business partners.
