On 2 November 2026 tracker channels relayed 24 new victims of The Gentlemen ransomware group in a single day. One of them is the State Health Department of Mato Grosso, Brazil. Every entry is the group’s own claim, and no statement from the department had appeared in the sources we checked as of 3 November 2026.
The counts below come from Brandefense Blackhole, which collects posts from ransomware-alert Telegram channels. We name only the public health body. We name no company, because these listings are unverified claims and none of the private cases is a widely reported breach.
What Did The Gentlemen Ransomware Claim on 2 November?
Brandefense Blackhole holds 24 tracker alerts dated 2 November 2026, each naming The Gentlemen as the group and a different victim. They were posted between 10:00 and 14:00 UTC. The tracker’s country field reads “N/D” in every alert, so the countries below are our reading of the description text each alert carries.
The department’s alert describes it as the state health department of Mato Grosso, responsible for public healthcare across 141 municipalities and 3.6 million inhabitants. Those two figures are the listing text of the tracker alert, not an official statement, and we have not matched them to a government page. The alert also lists hospitals, laboratories and a procurement portal, which we do not repeat as facts.
- Group.
- The Gentlemen (ransomware group).
- Day.
- 2 November 2026, 24 tracker alerts, 24 different victims.
- Public body named.
- State Health Department of Mato Grosso, Brazil.
- Figures in the listing.
- 141 municipalities and 3.6 million inhabitants, as the alert text says.
- Data or ransom demand shown.
- None in the alerts we hold.
- Official statement.
- None seen by us as of 3 November 2026.
Which Countries Appear in the Wave?
The 24 victims sit in 13 countries. The United States has the most with 5, followed by Brazil and the United Kingdom with 3 each. Canada, Spain and Switzerland have 2 each, and Germany, France, the Netherlands, New Zealand, South Africa, Ukraine and Venezuela have 1 each.
Country is our reading of the description text of each alert; we give no further detail on private organisations. In our reading of the alerts, Brazil is the only country in the list with a public body.
Which Sectors Does the List Cover?
The sector split is also ours, taken from each alert’s description, and some firms could sit in two groups. Industrial and engineering firms lead with 6 of the 24, followed by healthcare and logistics with 3 each. Two schools, two pharma or laboratory firms, two car sellers, two IT firms and two retail or real estate firms follow, then one law firm and one non-profit.
Healthcare is the sector this wave touches in three different forms: a public authority, a family practice and a dental clinic. Small practices and a state authority run very different systems, so we read the three as one sector by purpose only, not as one attack path.
How Does This Compare With Earlier Waves?
Brandefense Blackhole holds 74 tracker alerts naming The Gentlemen since 25 October 2026, each with a different victim. Of these, 38 were posted on 26 October, 3 on 27 October, 6 on 28 October, 3 on 30 October and 24 on 2 November. Our post on The Gentlemen’s one-day claim of 38 victims covers the earlier wave, so 2 November is the second large day in this window.
A plain search for the phrase “the gentlemen” returns 115 Telegram posts since 25 October, with 43 on 26 October and 31 on 2 November. Most of the rest is noise, such as betting posts and news digests that use the words in another sense. We therefore count the 74 tracker alerts, not the 115.
Our reading is that the 24 alerts come from one posting session; we cannot confirm this. We cannot tell from the alerts when the intrusions happened. For the group’s profile, see our The Gentlemen ransomware group page.
What Do We Know About the Mato Grosso Claim?
The tracker alert is the only source we hold for the health department claim. A search of Blackhole for “Mato Grosso” returns 4 posts since 25 October. Only one of them is this alert, and the other three are a card-generator feed and a news digest on Brazilian elections.
The alert only lists the department with a short description. It does not say what the group holds, shows no sample and gives no ransom amount. A real incident at a public body may bring a statement, which is why we looked for one. No statement from the department had appeared in the sources we checked as of 3 November 2026.
Until the department speaks, the right reading is a claim by a criminal group that wants attention and payment. That reading changes if the department confirms an incident, if samples appear, or if services are reported down.
What Should Public Health Bodies Do Now?
The steps below are our advice. They apply whether or not this claim is true, because health systems are a steady target for ransomware. Fewer exposed services also mean a smaller attack surface.
- Check your own logs firstWhen a group names you, review authentication, remote access and backup logs before you answer anyone.
- Test restoreRestore a clinical system from backup in a test environment and time it.
- Close remote accessPut remote desktop and VPN behind multi-factor sign-in, and remove accounts nobody uses.
- Keep a paper planKnow how admissions, medication and lab results continue if records systems are down.
- Watch for your nameMonitor leak-site and tracker posts for your organisation and suppliers. Brandefense Blackhole does this for dark web sources.
Method and Limits
All counts come from the saved Blackhole search for “the gentlemen” and “Mato Grosso”, dated 25 October to 3 November 2026. We counted tracker alerts by the group field and unique victim name. Countries and sectors are our classification from the text of each alert, so one or two items may sit differently under another reading. Day counts use the post’s publication time in UTC; the tracker’s own date field and our seen_at time give the same days.
We did not open the group’s own site and we link no leak-site, handle or file. We cannot say what, if anything, was taken from any listed organisation.