Layher Data Breach

Layher, a manufacturing company based in Chile, was listed on the leak site of the ransomware group The Gentlemen on August 23, 2026. Operating within the industrial and construction scaffolding sector and serving the South American market, Layher’s inclusion adds a Chilean manufacturing firm to the group’s growing list of victims. This incident highlights The Gentlemen’s expanding reach across Latin American geographies in recent weeks. In the past 60 days, The Gentlemen has claimed approximately 227 victims, with Manufacturing, Technology, and Other industries being the most frequently targeted. The United States, Germany, and the United Kingdom are the group’s primary victim countries. While Layher’s Chilean manufacturing profile aligns with the group’s documented sector focus, its Latin American operational geography represents a less common targeting vector. Notable victims with shared characteristics include Espac (Chile), ESCON Group (United States), and Akatake Engineering (Japan).

Initial access correlation against SOCRadar’s stealer-log telemetry returned no records for the domain layher.cl within the queried sample. It is important to note that a null result does not definitively confirm the organization is unaffected. The query covered a paginated sample, and the presence of credentials under alternate corporate domains or associated with personal email aliases could go undetected. Furthermore, credentials may have been used and subsequently rotated before being indexed in the dataset. Infostealer-harvested credentials are a significant initial access vector for ransomware groups. While no direct stealer-log evidence was identified for this specific domain in the current query, the absence of a finding in a limited sample does not rule out potential compromise. The Gentlemen’s operational profile is consistent with various entry paths, including phishing, exposed VPN appliances, and the reuse of compromised credentials. Affected organizations are strongly advised to audit their authentication logs, enforce multi-factor authentication on internet-facing services, and treat the listing itself as an indicator that the threat actor has gathered sufficient operational intelligence about the target.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.