The Gentlemen Ransomware Group Targets Australian Heritage Engineering Firm HBS Group
The Gentlemen, a rapidly rising ransomware group, has listed Melbourne-based heritage engineering firm HBS Group as a victim on its darknet leak site. The incident was disclosed in a July 23 post, part of a surge in which the hackers claimed over two dozen victims in a single 24-hour period.
The group provided minimal details, sharing only publicly available company information scraped from ZoomInfo and a countdown timer set for slightly over 150 hours at the time of reporting before further data exposure. HBS Group, which specializes in restoration, conservation, and complex engineering projects for heritage sites, has not responded to requests for comment.
Who Are The Gentlemen?
Emerging in September 2025, The Gentlemen have quickly climbed to second place in victim count, trailing only the Qilin ransomware-as-a-service (RaaS) operation. The group is believed to consist primarily of Russian-speaking threat actors and operates under a similar affiliate-driven model, offering partners 90% of ransom payments.
In a recent recruitment push, The Gentlemen announced a partnership with BreachForums, seeking skilled affiliates including penetration testers and access brokers to expand their global operations. Their most recent confirmed Australian victim was Royal Foods, which reported a cyber incident earlier in July.
About HBS Group
Headquartered in Alphington, Melbourne, HBS Group manages high-profile heritage projects, including:
- Sydney’s The Grace Hotel & Central Station Clock Tower
- Melbourne Town Hall
- Canberra’s John Gorton Building & Old Parliament House
The firm specializes in restoration, construction, and cladding replacement, emphasizing project management for sensitive and complex engineering works. The full impact of the breach remains unclear as investigations continue.
HBS Group TPRM report: https://www.rankiteo.com/company/hbs-group-southern-limited
Royal Foods TPRM report: https://www.rankiteo.com/company/royal-agricultural-society-of-victoria
"id": "hbsroy1785119067",
"linkid": "hbs-group-southern-limited, royal-agricultural-society-of-victoria",
"type": "Ransomware",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Engineering, Heritage Restoration & '
'Conservation',
'location': 'Alphington, Melbourne, Australia',
'name': 'HBS Group',
'type': 'Company'}],
'data_breach': {'data_exfiltration': True},
'date_publicly_disclosed': '2025-07-23',
'description': 'The Gentlemen, a rapidly rising ransomware group, has listed '
'Melbourne-based heritage engineering firm HBS Group as a '
'victim on its darknet leak site. The incident was disclosed '
'in a July 23 post, part of a surge in which the hackers '
'claimed over two dozen victims in a single 24-hour period. '
'The group provided minimal details, sharing only publicly '
'available company information scraped from ZoomInfo and a '
'countdown timer set for slightly over 150 hours before '
'further data exposure. HBS Group, which specializes in '
'restoration, conservation, and complex engineering projects '
'for heritage sites, has not responded to requests for '
'comment.',
'impact': {'data_compromised': True},
'investigation_status': 'Ongoing',
'motivation': 'Financial gain',
'ransomware': {'data_exfiltration': True},
'references': [{'source': 'Darknet leak site (The Gentlemen)'},
{'source': 'ZoomInfo'}],
'threat_actor': 'The Gentlemen',
'title': 'The Gentlemen Ransomware Group Targets Australian Heritage '
'Engineering Firm HBS Group',
'type': 'Ransomware'}