The pattern is what deserves your attention. The Gentlemen is a ransomware-as-a-service operation that emerged in mid-2025 and has listed hundreds of victims since. Earlier, EY was reportedly in the same position. Now Deloitte. Whether or not this specific claim holds up, the targeting logic is real: consulting firms hold client data across dozens of industries, which gives attackers maximum leverage from a single intrusion.
This is the double extortion economy working as designed. Encrypt the systems, exfiltrate the data, then get paid twice: once to restore access, once to keep the data unpublished. The leak site is the lever for the second demand.
Three defender takeaways
Your incident response plan probably assumes encryption. Most IR plans were written for the ransomware of 2019: systems go down, restore from backup, done. Data theft plus extortion is a different incident. It involves legal, communications, and client notification obligations. If your plan does not have a data-theft branch, it is incomplete.
Third-party risk is first-party risk. The reason consulting firms are attractive is the same reason your vendors are attractive: they hold your data with your trust attached. Your vendor risk program should assume a major supplier gets breached and ask what of yours goes with them.
The fundamentals still decide it. MFA everywhere with no exceptions, least privilege, continuous monitoring, tested recovery plans. None of that is new. All of it is what separates a claim on a leak site from a catastrophe.
One more thing worth saying plainly: ransomware is a business. The motivation is money, not prestige. Defenders who think in those terms, who ask "what would make us too expensive to bother with," make better decisions than defenders chasing the latest threat actor profile.
Kevin Swaney
Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com