US hospital operator Nutex Health has confirmed that attackers stole private or confidential data during a cyberattack it first disclosed on 24 August, and says the intruders have since threatened to publish the material. The Gentlemen ransomware-as-a-service gang claimed responsibility by listing Nutex on its leak site, though it provided no evidence to support the claim, a tactic commonly used to pressure victims in double-extortion attacks.

Nutex updated its SEC filing on Monday, reclassifying the incident from a general disclosure to one involving a "material cybersecurity incident," and confirmed that patient, employee, provider, business and financial information may have been exfiltrated, though the full scope is still being investigated. The company, which runs 28 hospital facilities across 12 US states, already faces a proposed class action filed on 27 August on behalf of those whose personal or health data may have been compromised. The Gentlemen group emerged in mid-2025, reportedly formed by former Qilin affiliates, and Microsoft has previously warned about its use of a self-propagating encryptor designed for rapid lateral movement across networks.