Machine sro
thegentlemen listed this organization on its leak site on Oct 9, 2026.
- Listing date
- Oct 9, 2026
- Attack date
- Oct 6, 2026
Listing text
k2machine.cz zoominfo.com/c/machine-sro/537154777 K2 Machine s.r.o. is a private Czech industrial machinery manufacturer founded in 2011 in Pardubice, Czech Republic, growing from 3 founders in a small office to ~25–50 employees and 400+ completed projects over 15 years. Annual turnover is 100+ million CZK (~€4M), though 2024 saw a sharp −18.7% revenue decline (operating revenue −27.7%). The company designs and builds special-purpose machines, automated production lines, robotic cells (including 3D Bin Picking), conveyor systems, and performs CNC machining, equipment repowering, and line relocation — serving primarily the automotive and consumer industries. Its full-cycle capability spans Solid Edge 3D design, EPLAN electrical engineering, CNC production, assembly, commissioning, and after-sales service under one roof at its own Semtín campus (since 2020).
About the group
thegentlemen posted its first listing on Sep 9, 2025 and has listed 1,253 organizations to date.
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Learning center
What does this listing mean?
Ransomware groups move data out of the organization before encrypting systems and threaten to publish it if the ransom is not paid. This method is called double extortion.
The listing shows that the group claims to have targeted the organization. Whether the data was published is shown by the later status of the listing.
What should you do if your organization is listed on a leak site?
- Record the listing and any published sample files; do not visit the leak site from the corporate network.
- Isolate affected systems and preserve logs without deleting them.
- Determine which data left the organization; if personal data is involved, review notification obligations with your legal team.
- Make any decision about the ransom demand together with legal, management and incident response.
- Do not bring systems back online before the attacker’s entry point is closed.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainIntelligence 360
Customer intelligence on top of Infostealer Detection: leaked accounts of end users who sign in to your site.