Tooltec Data Breach

Tooltec, a manufacturing company based in Sweden, was listed as a victim on The Gentlemen ransomware group’s dark web portal on July 16, 2026. This listing was identified through SOCRadar’s Dark Web Monitoring service. Operating within the Manufacturing sector, Tooltec falls into a pattern of recent leak-site activity by The Gentlemen, affecting various regions and industries. The company’s classification as a Swedish manufacturing entity aligns with the threat actor’s established targeting trends. In the 60 days preceding this listing, The Gentlemen claimed 132 other victims. The group predominantly targets the Business Services, Manufacturing, and Healthcare sectors, with a strong focus on victims located in the United States, Germany, and France. Notable previous victims of The Gentlemen that share a profile overlap with Tooltec include Mesto Celakovice, Giraudi Group, ALUFE Femszerkezeti Kft, and Dash Door Glass. Tooltec’s placement within this grouping as a manufacturing organization in Sweden is consistent with the group’s operational patterns.

SOCRadar’s stealer-log telemetry analysis for the domain tooltec.se yielded no records within the queried dataset. It is important to note that a null result does not definitively confirm the absence of compromise. The query performed retrieves a partial, paginated sample of data. Exposure could still exist through alternate corporate domains, personal email aliases, or data that was harvested and subsequently rotated before being indexed in the datasets. The queried domain did not surface any credentials in this specific data pull, and therefore, no definitive conclusions about a compromise can be drawn from this finding alone. For ransomware groups like The Gentlemen, credentials harvested by infostealers are a prevalent method for initial access. Threat actors or initial access brokers commonly source these credentials from underground marketplaces. They then validate the corporate account access obtained and utilize it to infiltrate systems such as Microsoft 365, VPNs, or remote-access portals, leading to subsequent ransomware deployment. The lack of evidence in this query does not preclude this scenario. Compromised credentials might exist in data feeds not included in this analysis, or they may have been used and rotated before the data was indexed. Furthermore, access could have been gained via personal email aliases associated with the organization. CTI teams should prioritize ongoing monitoring and proactive credential hygiene checks rather than interpreting a null query as exoneration. Such measures include continued dark web monitoring, proactive credential hygiene checks, regular password rotation, multi-factor authentication reviews, and thorough monitoring of alternate corporate domains, Microsoft 365, VPNs, and remote-access activity.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.