MegChem

This record is a provider-reported ransomware claim attributed to the gentlemen. It is an allegation and has not been independently confirmed.

Claim context

Group-published claim date
First tracked
Last observed
Monitoring providers
3
Independent monitoring providers
1
Website
megchem.com
Post URL
https://recentbreaches.com/breach/megchem-thegentlemen-2026-11
Data source
unified
Duplicate records merged
2

Provider observation timeline

Newest observations first. Provider observations are not independent confirmation of an incident.

  1. Monitoring provider: observed ; source-published ; retrieved .
  2. Monitoring provider: observed ; source-published ; retrieved .
  3. Monitoring provider: observed ; source-published ; retrieved .

Provider records

Every stored provider record behind this claim, newest first.

  1. Provider credit
    cybercrime.works
    Provider URL
    https://cybercrime.works/leaks/95c5d703-8128-40a8-8192-fbc890ba7cea
    Feed id
    cybercrime-works
    Provider record id
    95c5d703-8128-40a8-8192-fbc890ba7cea
    Observed
    Source-published
    Retrieved
    Format
    paginated-rest
    Transport
    https-rest
    Overlap class
    primary
    Independent corroboration
    no
  2. Provider credit
    RansomLook
    Provider URL
    https://www.ransomlook.io/
    Feed id
    ransomlook
    Provider record id
    derived-sha256:4a5a3bdf3f17aa0a9c98fbac3016d14e903adebe17b3cb78bd5e818c37cf962b
    MISP event UUID
    bc39cc1f-e598-555c-b3d8-821b38984216
    Observed
    Source-published
    Retrieved
    Format
    json-array
    Transport
    https-rest
    Overlap class
    primary
    Independent corroboration
    yes
  3. Provider credit
    RecentBreaches
    Provider URL
    https://recentbreaches.com/breach/megchem-thegentlemen-2026-11
    Feed id
    recentbreaches
    Provider record id
    derived-sha256:1162b2d7866007f66f4fe85f64018cfa53663c134d6d3611b042cc4b012062a1
    Observed
    Source-published
    Retrieved
    Format
    rss
    Transport
    https-rss
    Overlap class
    mirror
    Independent corroboration
    no

Tracker record history

Newest entries first. These dates describe tracker records, not attack dates.

  1. Provider update: recorded ; associated provider observation .
  2. Provider update: recorded ; associated provider observation .
  3. Initial tracker record: recorded ; associated provider observation .