Adkisson Group Data Breach

The ransomware group known as thegentlemen has claimed responsibility for a data breach targeting Adkisson Group, a professional services firm based in the United States. The claim was posted on the group’s leak site on August 30, 2026, with allegations of unauthorized access to company systems and data. It is important to note that this claim is currently unconfirmed by independent verification. Adkisson Group operates primarily through its website, adkissongroup[.]com. Thegentlemen has been active and prolific, listing 248 victims on its leak site within the past 60 days. The group’s targeting strategy predominantly focuses on organizations located in the United States and Great Britain, with a strong emphasis on the Manufacturing and Technology sectors. Adkisson Group’s profile as a professional services firm in the United States aligns with the established targeting patterns observed from thegentlemen.

SOCRadar CTI’s analysis of stealer-log data has yielded a “no_exposure_in_sample” verdict for Adkisson Group. This indicates that no credentials associated with the domain adkissongroup[.]com were found within the currently analyzed infostealer datasets. However, this result does not definitively clear the organization of any compromise. Initial access could still have been gained through alternative means, such as phishing attacks or the exploitation of publicly facing services. The absence of stealer-log records does not rule out the possibility of a security incident. Threat actors may utilize various initial access vectors that do not necessarily involve the exposure of credentials in readily accessible stealer logs. This could include exploiting unpatched vulnerabilities, leveraging stolen credentials obtained through other means, or social engineering tactics. Thegentlemen ransomware group’s activity highlights the importance of continuous monitoring for credential exposure and the implementation of robust security practices. Organizations should maintain vigilance regarding their dark web presence and actively monitor for any signs of their data or credentials appearing in underground forums. Proactive measures such as regular credential hygiene checks, timely password rotation, and comprehensive multi-factor authentication reviews across all accessible services, including Microsoft 365, VPNs, and remote access portals, are crucial for mitigating the risk of future attacks.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.