All ransomware incidents
Ransomware group thegentlemen hits Grupo Lorrio
Grupo Lorrio — a manufacturing target operating in ES has been listed by the thegentlemen ransomware group on 2026-11-02. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | Grupo Lorrio |
|---|---|
| Threat Group | thegentlemen |
| Summary | Grupo Lorrio, a manufacturing organization in Spain, was listed by the thegentlemen ransomware group on its leak site on 2026-11-05. |
| Date of Breach | 2026-11-02 |
| Discovery Date | 2026-11-05 |
| Region | ES |
| Target Domain | grupolorrio.es |
| Business Sector | Manufacturing |
| Severity | MEDIUM |
Claim by thegentlemen
grupolorrio.es Grupo Lorrio is a Spanish industrial engineering and construction group founded in 1989 in San Fernando de Henares, Madrid, formerly known as J Lorrio SL and rebranded in 2020. Led by sole owner and administrator Raúl Lorrio González, the group comprises J. Lorrio, Lorclima and Grupo 6, offering full lifecycle services from engineering design to installation and maintenance of industrial systems. Its 14 technical specialties include fire protection, HVAC, refrigeration, compressed air, steam, plumbing, electrical, insulation and intelligent building management. The company holds triple ISO certification covering quality, environmental management and occupational health and safety. With 4 to 10 employees and revenue up to 1.5 million euro, it serves industrial clients across the Madrid region with a no-exclusivity policy that ensures best-fit solutions. Its integrated model covers project, construction, maintenance and energy management phases in one continuous service.
Posted by the thegentlemen threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.