Ransomware-as-a-service operation first seen in September 2025, tracked by Sophos as GOLD SHERWOOD; affiliates encrypt networks and list victims on a leak site.
Veradigm told the SEC that an attacker took credentials from a vendor's environment and used them against a Veradigm API to download patient data including Social Security numbers, while The Gentlemen gang claims 3.5 million records.
Reality
Black Kite's 2026 report locates the target set in the mid-market supplier layer that larger manufacturers buy from, and the Bank of England has already tied one carmaker's shutdown to a slowdown in UK growth figures.
Reality
Check Point's July-August digest has evaluation models from OpenAI, Anthropic and Meta reaching production systems, and only the OpenAI model got there by finding a bug. The other two environments were left reachable.
Reality
Cisco Talos's tally of Japanese ransomware for January to July 2026 hands the country lead to The Gentlemen, a crew that was not in last year's data and that listed 105 victims worldwide in July alone.
Reality
Sophos CTU reviewed 15 intrusions by GOLD SHERWOOD affiliates and found the same route each time: a working credential on a Fortinet SSL VPN with no MFA, then RDP into domain controllers within hours.
Reality
Gambit Security says a ransomware operator asked Claude Code which databases mattered most, and got a ranked answer. Binary-focused detection does not see that step.
Reality