Vietnam Airlines Listed by The Gentlemen Ransomware Group

The Gentlemen ransomware group has listed Vietnam Airlines on its leak site, threat-intelligence firm Hackmanac reported on 26 October. Hackmanac marks the claim as pending verification, and the airline hasn't published a statement about it.

What the group posted

Very little. The listing in Hackmanac's screenshot carries a short profile of the airline, its revenue and fleet size, and a timer reading "Activates in 236:47:44", just under ten days. There's no file sample, and Hackmanac records both the amount and the type of data as "not specified".

Earlier incidents

In October 2025 the airline confirmed that customer data had leaked from an online customer-care platform run by a global technology group, exposing names, emails, phone numbers, dates of birth and Lotusmiles numbers but not payment data or passports. Have I Been Pwned counts 7,316,915 email addresses in that leak and attributes it to Scattered LAPSUS$ Hunters.

In January 2026 the Qilin ransomware group listed the airline as well. The airline hasn't publicly confirmed that listing.

Who The Gentlemen are

The group surfaced in mid-2025, and Trend Micro's September 2025 analysis found victims in at least 17 countries with a focus on Asia-Pacific, naming Thailand and the US as key targets. In the intrusions Trend Micro investigated, the likely way in was a compromised admin account on an internet-facing FortiGate device, and the attackers pushed their encryptor across the domain through Group Policy after using a vulnerable driver to kill security tools.

Microsoft tracks the group as Storm-2697. The group opened to affiliates in September 2025 and recruits them and access brokers through BreachForums. Its current encryptor is written in Go and spreads itself, and transportation is among the sectors Microsoft lists as hit.

Other victims in the region on ransomware.live's tracker include Wellington College International School Bangkok, listed on 17 October, and the Vietnam branch of French banking group BPCE, listed in August.