The Gentlemen ransomware group has added Eichstätt to its leak site and says it stole about 1.5 TB of data. The listing went up on 31 October 2026. The victim is the town's municipal administration, the Stadt Eichstätt in Upper Bavaria, and not the Catholic University of Eichstätt-Ingolstadt. The listing names the city's domain, eichstaett.de, and the attack matches a ransomware incident the city has already confirmed. The university comes up only because the leak-site entry's description text mentions it. Trackers then repeated that text, and it does not mean the university was hit.
The city says attackers got into town hall systems on the night of 8 to 9 October, encrypted data, and copied what officials call "a large part" of the administration's data. The city has not confirmed that The Gentlemen were responsible, and nobody has checked whether the 1.5 TB figure is accurate.
What Happened
Golem.de and Bavarian broadcaster BR report the following sequence. Staff reported IT problems on the morning of Monday 13 October. The city's IT department then took all systems offline. The administration's own updates say the intrusion started on the night of 8 to 9 October. Golem.de reported that unknown attackers had probably got in over the weekend, which fits that date.
On the Tuesday, after working with police and the Bavarian State Criminal Police Office (LKA), the city confirmed that the attackers had "succeeded in copying a large part of the city administration's data." BR reported on 23 October that the LKA had traced the copied data to a server abroad.
The city's 22 October statement says the attackers told the administration about the break-in once the attack was finished, but sent no explicit ransom demand. The city says it will not give in to extortion. In its words, the city "presumably fell into the criminals' sights completely by chance" as a customer of an affected software product. It sees no targeted or political motive, and it says an international investigation is under way.
Disruption has been significant. All town hall servers were kept offline to preserve forensic evidence, and email and phone contact were limited. Communication with a local hospital was also restricted. Some services, such as the civil registry and public order offices, came back in reduced form from 15 October. The municipal utility, Stadtwerke, was not affected. The administration has been working in emergency mode and is restoring systems from working backups.
Accounts differ on dates. Leak-site tracking pages give an "estimated attack date" of 27 October and say Dark Web Intelligence published the claim the same day. The listing date given by ransomware.live and related trackers is 31 October. Both dates are well after the 8 to 9 October intrusion the city describes. The likeliest explanation is that the later dates show when the claim was posted, not when the attack happened. The city has not commented publicly on the leak-site listing.
What Was Taken
Volume. The Gentlemen claim about 1.5 TB. QPulse, cyberthreatintelligence.net and the body of an Undercode News report all give that figure. Undercode News's headline says "15 TB", but its own text says 1.5 TB, so the headline looks like a typo. No authority has verified the volume.
Scope. The city says most of the administration's stored data was copied. That is the strongest confirmed statement available, and it comes from the victim itself.
Content. Mayor Josef Grienberger (CSU) told BR he expects the stolen data to include residents' personal data, though the analysis was not finished at the time. "I don't suspect it's the mayor's payslip, but probably personal data of citizens," he said. He pointed to the registration office (Einwohnermeldeamt), which holds residents' registration records. Municipal administrations also usually hold tax, permit, social services and staff records. None of these categories has been confirmed as stolen.
Follow-on risk. The city has warned residents that fake official invoices and other fraud attempts may follow. A leak-site listing usually comes before publication, so if the city does not pay, which it has said it won't, the data may be released.
Why It Matters
Small German municipalities are a common ransomware target. They hold dense registers of personal data, and their IT teams are small. Eichstätt has about 13,500 residents. For this kind of victim, recovering from backups solves the encryption but does nothing about the data theft. Eichstätt had working backups and still lost control of most of its data.
The group matters too. Threat-intelligence profiles describe The Gentlemen as a ransomware-as-a-service operation that appeared around July to August 2025. It reportedly offers affiliates a 90% revenue share and uses a locker written in Go that targets Windows, Linux, NAS and BSD systems. Figures for its size vary widely. One profile says it claimed more than 320 victims in 17+ countries in its first months. The same tracker page lists 922 and 1,131 victims in different places. The profile also says a compromised command-and-control server found in 2026 pointed to more than 1,570 linked victims. Whichever figure is right, the group is operating at large scale, and Germany ranks among its most-listed countries on that tracker.
The city's finding that it was hit "by chance" through a software product it uses suggests a campaign across many customers of one product, not a targeted attack. Other German public bodies using the same software could be exposed. The city has not named the product.
The Attack Technique
What the city says. According to the administration, the attackers most likely got in through a vulnerability connected to software the city uses, even though two-factor authentication was in place. The city says it has no evidence of phishing and no sign that an employee clicked a malicious link. The attack followed the usual double-extortion pattern: data was copied out, then systems were encrypted.
What third parties suggest. QPulse, citing an exposure report from ParanoidLab, says 96 passwords and 11 browser cookies linked to the target turned up in infostealer data. It concludes that infostealer infections "may have played a role." That theory has not been corroborated, and it does not fully fit the city's account of a software vulnerability. Treat it as a possible contributing factor, not an established cause.
How The Gentlemen operate generally. In September 2026, Cisco Talos rebuilt one Gentlemen-linked operator's toolchain from an exposed open directory. Nothing yet ties these techniques to the Eichstätt intrusion, but they show the group's methods:
- Initial access through public-facing applications: exploit attempts against CVE-2025-24799, an unauthenticated SQL injection in GLPI fixed in 10.0.18, and a cPanel/WHM authentication-bypass proof of concept
- Pivoting and discovery: Chisel, Ligolo, nmap, masscan, NetExec and BloodHound-style Active Directory collection with RustHound
- Privilege escalation: signs of Zerologon (CVE-2020-1472) and MS17-010 exploitation, plus NTLM relay through Responder
- Credential theft from backups: mounting the victim's own VHDX backup images over CIFS to pull
ntds.ditand the SAM database for offline cracking - Exfiltration: chunked rclone transfers to Wasabi cloud storage
Valid accounts (MITRE T1078) are the technique trackers most often link to the group. That fits both a vulnerable product and the use of stolen credentials.
What Organizations Should Do
- Patch and inventory internet-facing software, including vendor-hosted products. The city's account points to a flaw in third-party software that 2FA did not stop. Keep a current list of every exposed application, including IT service management tools like GLPI and hosting panels like cPanel/WHM, and patch them quickly.
- Lock down backup repositories. Talos's findings show The Gentlemen use backups as a source of credentials. Keep backup shares off the general domain network, require separate credentials, and alert when VHD/VHDX images are mounted or bulk-read from unexpected hosts.
- Treat infostealer exposure as an incident. Monitor for staff credentials and session cookies appearing in infostealer logs. When they do, reset passwords, revoke sessions and reimage the device. Session cookies can get past 2FA.
- Watch for bulk exfiltration. Alert on rclone and similar sync tools, and on large outbound transfers to cloud storage providers such as Wasabi, especially outside working hours.
- Harden Active Directory against known attack paths. Confirm the Zerologon and MS17-010 patches are in place, disable LLMNR/NBT-NS to block Responder-style relay, enforce SMB signing, and run your own BloodHound review before attackers do.
- Prepare for the leak, not just the outage. Public bodies should have resident notification, fraud warnings and data-protection authority reporting ready before data appears on a leak site, as Eichstätt did when it warned residents about forged invoices.
Sources: Thegentlemen Ransomware Group Claims Attack on Eichstatt, Exfiltrat... | Eichstatt Ransomware Attack by Thegentlemen (2026) Cyber Threat In... | Nach Cyber-Angriff in Eichstätt: Daten liegen jetzt im Ausland BR24 | The Gentlemen Ransomware Targets German Town of Eichstätt: 15 TB Da... | Großer Datenabfluss: Verwaltung von Eichstätt gehackt - Golem.de | Cyber-Attacke auf Stadtverwaltung war kein gezielter Angriff - Stad... | Ville d'Eichstätt data breach report (2026) — press coverage, not a... | The Gentlemen's open-directory attack toolchain: mounting a victim'...