Mandurah SES Data Breach

Mandurah SES, a State Emergency Service unit operating in Western Australia, was listed on the dark web leak site of the ransomware group known as The Gentlemen on October 3, 2026. The group claims to have exfiltrated data from the emergency services unit. This type of data often includes sensitive personal information of volunteers, detailed operational response plans, inter-agency communication protocols, and records of collaboration with other emergency response agencies. The Gentlemen ransomware group has demonstrated a pattern of targeting public sector and emergency service organizations within the last 60 days. These organizations are often vulnerable due to limited IT budgets, a scarcity of dedicated cybersecurity personnel, and the critical nature of their operations, which can create pressure to pay ransoms to restore services quickly. The Australian Cyber Security Centre (ACSC) has highlighted the increasing trend of ransomware attacks against Australian emergency services, noting the direct implications for public safety.

SOCRadar’s analysis of stealer-log intelligence did not reveal any confirmed credential records directly associated with Mandurah SES’s digital infrastructure. However, the limited external digital footprint typical of a regional State Emergency Service unit can reduce the visibility of such data in stealer logs. It is plausible that initial access was gained through phishing campaigns targeting the accounts of volunteers or staff, potentially on government IT platforms managed by third parties or through shared services. Compromises occurring through a supply chain or a shared service provider might not be reflected in stealer data attributed to the SES unit’s own primary domain. The absence of direct stealer-log correlation does not definitively rule out a compromise. The methods used by The Gentlemen group often involve phishing or exploiting vulnerabilities for initial access. In the case of a regional emergency service, which may rely on shared IT infrastructure or third-party services, credentials harvested through these means could be utilized without appearing in logs directly tied to the victim organization’s specific domain. This highlights the importance of comprehensive monitoring and proactive security measures, especially for organizations like emergency services where operational continuity is paramount. The potential impact of a successful attack on an emergency service unit like Mandurah SES extends beyond mere data exfiltration. The inability to access critical operational plans or communication logs during a disaster event constitutes a significant public safety risk and a failure in community preparedness. Therefore, any alleged data exposure involving such an organization should be treated as a sensitive incident, irrespective of whether data encryption was a component of the attack. Recommended next steps include immediate engagement with the ACSC and relevant state cybersecurity teams for assessment and guidance, a thorough evaluation of volunteer and staff data exposure for personal safety implications, and the mandatory enforcement of multi-factor authentication across all digital platforms used by volunteers and staff. Participation in ACSC threat intelligence sharing programs is also advised to ascertain if this incident is part of a wider pattern of attacks targeting the public sector.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.