RANSOMWARE VICTIMMANUFACTURING

EMCO Holding

THEGENTLEMEN📍 Germany (DE)📅 April 7, 2026
8
same group

Attack Intelligence

EMCO Holding was compromised in a ransomware attack attributed to THEGENTLEMEN in April 2026. The organization, operating in the Manufacturing sector in Germany, was added to the group's data leak site as part of an extortion campaign.

THEGENTLEMEN operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

emcoholding.com Grupo EMCO Holding is a conglomerate of prestigious companies operating in different areas, guided by a philosophy of excellence and responsibility, with significant investments in Central America. In recent years, the group has diversified and has strongly positioned itself in fields such as the airport sector, cargo terminals, steel production, and steel manufacturing, and is currently developing energy generation projects. Thanks to its major projects, rapid growth, and investments, Grupo EMCO has established itself as one of the most important, strongest, and most prestigious groups in Central America.

Other Victims — THEGENTLEMEN (8)

Quick Facts

CountryGermany (DE)
SectorManufacturing
Attack DateApr 7, 2026
Intel Sourceransomlook

Threat Group

THEGENTLEMEN
Motivation: financial
View group profile →

External Links

Data sourced from Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Victim listing does not imply confirmed breach — intelligence based on group claims.