Metro Mondego Data Breach

Metro Mondego, a transportation and logistics company based in Portugal, has been identified as a victim on the dark web portal of the ransomware group known as The Gentlemen. This listing, published on July 16, 2026, was detected by SOCRadar’s Dark Web Monitoring service. Operating within the Transportation/Logistics sector, Metro Mondego’s inclusion in this dataset highlights its placement within The Gentlemen’s recent pattern of leak-site claims, which have impacted various regions and industries. Within the 60 days preceding this listing, The Gentlemen ransomware group claimed 132 other victims on its leak portal. The group predominantly targets the Business Services, Manufacturing, and Healthcare sectors, with a significant concentration of victims located in the United States, Germany, and France. Other organizations recently listed by The Gentlemen that share similarities with Metro Mondego’s profile include Ce Ratp Comite D entreprise Ratp, Spedidam, Quanterm Logistics Sdn Bhd, and LogiQuip. While Metro Mondego’s specific sector is not among the group’s most frequently targeted, this listing provides a valuable insight into the expanding scope of The Gentlemen’s victimology.

SOCRadar’s analysis of stealer-log telemetry for the domain metromondego.pt did not return any records within the queried dataset. It is important to note that a null result does not conclusively indicate that the organization is unaffected. The querying methodology involves a partial, paginated sample, and the potential for exposure remains if credentials are held under alternate corporate domains, utilize personal email aliases, or if records were harvested and rotated prior to their inclusion in the indexed feed. The absence of credentials associated with the queried domain in this specific analysis should not be interpreted as evidence of no compromise. Infostealer-harvested credentials are a well-established vector for initial access used by ransomware operators such as The Gentlemen. Threat actors or initial access brokers often source credentials from underground marketplaces, validate their authenticity, and then use them to gain unauthorized access to corporate environments through platforms like Microsoft 365, VPNs, or remote-access portals, subsequently deploying ransomware. The lack of evidence in this particular query does not preclude such a scenario, as credentials may have appeared in datasets not covered by this analysis, been rotated after their initial harvest, or accessed via personal email accounts. Consequently, CTI teams are advised to maintain continuous monitoring and conduct proactive credential hygiene checks rather than relying on a null query as definitive proof of security.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.