The Gentlemen come calling as Nutex confirms sensitive data theft
US hospital operator Nutex Health has confirmed that attackers stole private or confidential data during a cyberattack it first disclosed on 24 August, and says the intruders have since threatened to publish the material. The Gentlemen ransomware-as-a-service gang claimed responsibility by listing Nutex on its leak site, though it provided no evidence to support the claim, a tactic commonly used to pressure victims in double-extortion attacks.
Nutex updated its SEC filing on Monday, reclassifying the incident from a general disclosure to one involving a "material cybersecurity incident," and confirmed that patient, employee, provider, business and financial information may have been exfiltrated, though the full scope is still being investigated. The company, which runs 28 hospital facilities across 12 US states, already faces a proposed class action filed on 27 August on behalf of those whose personal or health data may have been compromised. The Gentlemen group emerged in mid-2025, reportedly formed by former Qilin affiliates, and Microsoft has previously warned about its use of a self-propagating encryptor designed for rapid lateral movement across networks.
- Nutex Health confirms hackers stole sensitive patient and staff data
- The Gentlemen ransomware gang claims responsibility, threatens to leak data
- Class action already filed; investigation into scope continues
New here? Start with this
Nutex Health is a US company that runs 28 hospital facilities in 12 states. Hospitals hold sensitive information about patients and staff, as well as business and financial records, so a breach can affect people beyond the organisation itself.
Ransomware groups break into computer networks to steal data and may also lock files or threaten to publish what they have taken. The Gentlemen is a group that claims to use this approach; a listing on its leak site is a claim by the attackers and does not by itself establish what they accessed.
The incident matters because exposed health or personal details can create risks for the people concerned, while a cyberattack can disrupt an organisation’s operations. Nutex is still investigating what information may have been taken, and people who say their data may be affected have brought a proposed class action.