The Gentlemen claim Glassdoor

Status: STALLED — DEADLINE LAPSED, STILL UNVERIFIED. The Gentlemen’s own 172-hour countdown expired on 4 September 2026 with no data published. Three weeks on, Glassdoor, Indeed, and Recruit Holdings have made no statement, no breach notification filing has surfaced in public trackers, and the one sample analysis in public reporting found too little to confirm or characterize a breach. None of that proves the claim is false — silent negotiation is a normal pattern too — but “developing” overstated where this now sits. See the update log for what’s actually changed.

The claim, as posted

On 30 August 2026 at 09:54 UTC, the leak-site tracker Ransomware.live indexed a new victim listing: Glassdoor, claimed by the operation it tracks as “thegentlemen,” with an estimated attack date of 28 August 2026. The actor’s post itself carries a publication timestamp of 28 August 2026 at 16:44 UTC.

That is, at present, the entire evidentiary record. The listing describes the target — a U.S. job platform, owned by Recruit Holdings/Indeed, hosting millions of anonymous reviews for roughly 600,000 companies — but public reporting so far includes no data inventory, no ransom figure, no deadline, and no published samples. Trackers carrying the listing attach the standard disclaimer: the post reflects the group’s own claims and cannot be confirmed.

A listing with no samples is a pressure instrument. The Gentlemen’s model, like every double-extortion operation, front-loads the announcement precisely because the negotiation window opens before the proof does. The absence of published data at this stage is normal and tells you nothing in either direction about whether the intrusion is real.

Why this target is different

Two things separate this from the week’s other victim listings.

The first is timing. Glassdoor was legally merged into Indeed on 1 July 2026 under parent company Recruit Holdings — the estimated attack date lands less than two months into that integration. Mergers are historically productive hunting ground: identity systems being consolidated, access being re-provisioned, two security stacks becoming one, and organizational attention pointed at the integration chart rather than the edge. Whether that dynamic played any role here is unknown; that attackers seek it out is not.

The second is what the platform is. Glassdoor’s entire product is a promise: reviews are anonymous. The database that keeps that promise — the backend linkage between real accounts and “anonymous” reviews of employers — is precisely what a full compromise would expose. Most ransomware victims lose files. A breach here, if real and if it reached that linkage, would retroactively de-anonymize people who criticized their employers in writing, some of them years ago, in jurisdictions and industries where that carries real professional and legal consequences. The harm model is closer to the Ashley Madison precedent than to a stolen file server.

That is worth stating carefully: no evidence currently shows review-identity data was accessed. But it is the reason this listing warrants attention before verification, not after.

Who are the Gentlemen

The claiming operation is well documented, even if this claim is not.

The Gentlemen — tracked by Microsoft as Storm-2697 — is a ransomware-as-a-service program active since at least July 2025, with lockers written in both C and Go to cover different operating systems and virtual infrastructure. Before launching under their own brand, the operators worked as ArmCorp, an affiliate of the Qilin RaaS; the split went public on 22 July 2025 when the actor “hastalamuerte” posted a complaint on the RAMP forum alleging Qilin owed roughly $48,000 in unpaid commissions. The first Gentlemen sample had already appeared on VirusTotal on 17 July — five days before the dispute surfaced — with the leak-site URL already embedded in the binary. The divorce was planned before it was announced.

Growth since then has been unusual even by RaaS standards. Unit 42 counted 580 claimed victims across 77 countries through 7 July 2026, making the operation the second most active RaaS of the year; Comparitech’s 18 August analysis put the running tally at 675. The engine behind that volume is a 90/10 affiliate split — among the most generous terms advertised on underground forums — bolted to a structured core team that leaked internal communications suggest numbers around nine operators, handling locker development, affiliate management, and negotiations centrally.

Two operational details matter for reading the Glassdoor listing. First, the group runs classic double extortion — encrypt, threaten publication — but has recently expanded its leak site to publish breach summary reports alongside victim names: intrusion narratives, affected systems, stolen-data estimates, screenshots. If the Glassdoor claim is substantive, expect that artifact next. Second, the group observes the standard CIS-country targeting prohibition, consistent with public assessments placing the operators in Russian-speaking regions.

One more data point for the file: in May 2026 the Gentlemen suffered a breach of their own backend, exposing internal chats, affiliate details, and negotiation transcripts. Prolific does not mean untouchable.

The vector: what is not known, and what usually is

No intrusion vector for this incident has been published. Nothing below is attribution for the Glassdoor claim — it is the group’s documented playbook, which is the only available basis for defensive inference.

The Gentlemen’s known tradecraft centers on the network edge. Defensive guidance from Unit 42 emphasizes visibility into internet-facing systems — firewalls, VPNs, remote access gateways — and auditing for indicators of prior exploitation of edge devices and internet-facing RDP endpoints. That last clause is the telling one: the group’s affiliates are known to move through access that predates them.

Which makes one adjacent dataset worth logging without overreading. HudsonRock infostealer telemetry associated with the glassdoor.com domain shows 18 compromised employee machines, 45,236 compromised user credentials, and 16 third-party employee credentials. Infostealer-harvested credentials are one of the most common precursors to ransomware access across the ecosystem — but no public reporting connects that telemetry to this intrusion, and the user-credential figure largely reflects consumers whose own machines were infected, not Glassdoor’s infrastructure. It sits in this section as context for the follow-up, not as a finding.

Exposure surface: what a real breach would mean

With no data inventory published, the honest framing is capability, not fact. What the platform holds, per its own public footprint: account data for a user base measured in the tens of millions; the review corpus and its backend identity linkage; self-reported salary data; and employer-side commercial relationships inherited into the Indeed integration.

The tiering matters. Leaked corporate files would make this an ordinary ransomware incident. Leaked account tables would make it a large but familiar credential event. Leaked review-identity linkage would make it a category-of-its-own privacy failure with a long tail of individual harm. Until samples surface or the company speaks, there is no basis for placing the incident in any of the three tiers — including the mildest.

The silence from the company

As of publication, three days after the leak-site post: no statement from Glassdoor, no statement from Indeed, no statement from Recruit Holdings, no breach notification filings surfaced in public reporting, and no coverage from major security press — the record consists entirely of leak-site trackers indexing the actor’s own post.

Silence at day three is not evidence of anything. Verification takes longer than a news cycle, and companies mid-merger have more lawyers than most in the approval chain. But the clock that matters is the one the Gentlemen’s negotiation process runs on — and their recent pattern of publishing breach summary reports means the next public artifact may come from the actor, not the company.

Update, three weeks out: the silence held past the actor’s own clock, too. The Gentlemen’s leak-site post carried a 172-hour countdown from its 28 August timestamp — a deadline landing around 4 September at roughly 20:44 UTC. That deadline passed with no data published: ransomware.live’s own listing carries no “published” marker as of this update, and no security outlet has reported seeing leaked files. Recruit Holdings’ September newsroom activity was limited to routine shareholder notices — a dividend announcement and a share-repurchase update — with no mention of a security incident. No breach notification filing referencing Glassdoor has surfaced in the public state attorney-general trackers checked for this update. Glassdoor, Indeed, and Recruit Holdings still have not made a statement.

The one substantive addition to the evidentiary record is a sample analysis from SOCRadar, and it cuts toward “inconclusive” rather than “confirmed”: per SOCRadar’s own reporting, the material it reviewed consisted of roughly 25 records, entirely consumer email addresses, with no timestamps tying them to a specific compromise window and no employee credentials among them. That’s consistent with a possible customer-side exposure, with an old stealer-log dump repackaged as a fresh claim, or with nothing at all beyond a proof-of-access gesture — the sample is too thin to distinguish between those. SOCRadar’s own assessment was that it doesn’t rule out a broader compromise; it also doesn’t establish one.

A deadline lapsing without published data is not, by itself, evidence the claim is fabricated — real double-extortion negotiations commonly continue privately well past a public countdown, and a company mid-investigation has good reason to stay quiet until it has something accurate to say. But three weeks of total silence, on all sides, is enough to downgrade this from “developing” to “stalled”: there is currently nothing in public reporting that moves this claim closer to confirmed or closer to false.

Assessment

Confidence levels:

• The Gentlemen listed Glassdoor on their leak site on 28 August 2026, indexed by trackers on 30 August — high (directly observed by multiple independent leak-site monitors).
• An actual intrusion into Glassdoor/Indeed infrastructure occurred — unverified (single-source: the actor’s own claim; no samples, no company confirmation, no independent reporting).
• Initial access via edge infrastructure or previously harvested credentials — low (inference from the group’s documented playbook and adjacent infostealer telemetry; nothing incident-specific published).
• Review-identity linkage data was accessed — no evidence (stated here only as the platform’s worst-case exposure surface, not as a claim).
• The 25-record consumer-email sample SOCRadar analyzed reflects a genuine, incident-specific Glassdoor compromise — unverified (no compromise-window timestamps, no employee credentials in the sample, and no independent confirmation the records didn’t predate this claim).
• The claim is a bluff or a reused/exaggerated listing rather than a real intrusion — unverified (the lapsed deadline and continued silence are consistent with this, but equally consistent with an ongoing private negotiation; nothing published distinguishes the two).

Sources

• hxxps://www[.]ransomware[.]live/id/R2xhc3Nkb29yQHRoZWdlbnRsZW1lbg==
• hxxps://unit42[.]paloaltonetworks[.]com/the-gentlemen-ransomware/
• hxxps://www[.]halcyon[.]ai/ransomware-research-reports/threat-assessment-the-gentlemen-ransomware-group
• hxxps://blackpointcyber[.]com/threat-profile/gentlemen-ransomware/
• hxxps://www[.]fortiguard[.]com/threat-actor/6387/the-gentlemen-ransomware
• hxxps://www[.]cybereason[.]com/blog/the-gentlemen-ransomware
• hxxps://www[.]hendryadrian[.]com/ransom-glassdoor-aug-2026/
• hxxps://datafloq[.]com/glassdoors-ransomware-deadline-expired-two-weeks-ago-the-data-never-showed-up/
• hxxps://www[.]paubox[.]com/blog/ransomware-crew-gives-glassdoor-a-172-hour-countdown
• hxxps://www[.]teiss[.]co[.]uk/news/ransomware-group-thegentlemen-claims-glassdoor-breach-sets-deadline-for-alleged-data-release-18075
• hxxps://socradar[.]io/data-breach/glassdoor-thegentlemen-2026/

Update log

• 2026-08-31 — Initial publication. Claim indexed, no company statement, no samples, no vector.
• 2026-09-23 — The Gentlemen’s 172-hour countdown (deadline ~4 September, 20:44 UTC) lapsed with no data published; ransomware.live’s listing still carries no “published” marker. Still no statement from Glassdoor, Indeed, or Recruit Holdings — Recruit’s September newsroom shows only routine shareholder notices. No breach notification filing found in public attorney-general trackers. SOCRadar’s sample analysis (~25 consumer email records, no compromise-window timestamps, no employee credentials) is the only new evidentiary artifact, and it’s inconclusive rather than confirmatory. Status downgraded from “developing” to “stalled.” Assessment section updated accordingly.
• (reserved for further follow-up: company statement / additional sample analysis / breach summary report / regulator filings)