Ransomware group 'The Gentlemen' claims breach of 1,900 HKBU credentials

The Gentlemen's rapid rise through a revenue-sharing ransomware model signals a shift in how cybercriminals scale their operations. By targeting a major university, the group tests the resilience of academic networks and the speed of regulatory notification, with 1,900 credentials potentially in the wild.

Hong Kong Baptist University (HKBU) is actively reviewing its IT security after a ransomware group calling itself 'The Gentlemen' claimed online to have illegally accessed the institution's data. According to cybersecurity monitoring platforms, approximately 1,900 credentials tied to the university may have been compromised, including around 130 staff accounts, 1,770 other user accounts, and 260 third-party employee credentials. The group, which first surfaced in mid-2025, operates a ransomware-as-a-service (RaaS) model—renting its extortion tools to affiliate hackers in exchange for a cut of the profits. This revenue-sharing approach has allowed The Gentlemen to scale rapidly, mirroring the evolution of groups like LockBit and BlackCat, and now threatens a broad range of targets, including higher education.

“

Hong Kong Baptist University (HKBU) is actively reviewing its IT security after a ransomware group calling itself 'The Gentlemen' claimed online to have illegally accessed the institution's data.

HKBU's initial response came in a statement on the evening of August 11, 2026, confirming it had noted the webpage alleging the breach. The university said it was closely reviewing the security of its IT systems and personal data, and would take appropriate action under established mechanisms while remaining in contact with local regulators and law enforcement. Crucially, the Office of the Privacy Commissioner for Personal Data disclosed that it had not received any official breach notification from the university as of that date, though the watchdog proactively reached out to understand the incident. This gap—between the public claim and formal regulatory notification—highlights a compliance risk under Hong Kong's data protection framework, where organizations are expected to report breaches without undue delay.

Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, urged an aggressive incident response: immediate notification to the privacy commissioner, comprehensive forensic and system checks, campus-wide password resets, enforcement of multi-factor authentication (MFA), and transparent communication with staff and students to thwart further social-engineering attacks. His recommendations reflect a consensus among cybersecurity professionals that containment speed is critical when credentials are potentially leaked. The exposure of third-party credentials further complicates the incident, as it extends the blast radius to vendors and partners who may lack the university's defensive posture.