All ransomware incidents
Ransomware group thegentlemen hits National Agency Programmes and Mobility
National Agency Programmes and Mobility — a government & defense target operating in MK has been listed by the thegentlemen ransomware group on 2026-11-11. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | National Agency Programmes and Mobility |
|---|---|
| Threat Group | thegentlemen |
| Summary | National Agency Programmes and Mobility, a government & defense organization in North Macedonia, was listed by the thegentlemen ransomware group on its leak site on 2026-11-12. |
| Date of Breach | 2026-11-11 |
| Discovery Date | 2026-11-12 |
| Region | MK |
| Target Domain | na.org.mk |
| Business Sector | Government & Defense |
| Severity | MEDIUM |
Claim by thegentlemen
na.org.mk The National Agency for European Educational Programmes and Mobility is a government institution in Skopje, North Macedonia, established in 2006 to administer EU education and mobility programs including Erasmus+, Erasmus Mundus and the European Solidarity Corps. Over 20 years it has managed more than 2,500 projects involving 50,000 plus mobile participants and administering over 200 million euro in EU grants. Its activities cover higher education, vocational training, school education, youth and sport through Erasmus+ Key Actions 1, 2 and 3. The agency partners with over 1,000 organizations including universities, schools, NGOs and companies across 33 Erasmus+ countries. It also operates Eurodesk, eTwinning and Youthpass platforms for youth information and certification. Led by a director and board appointed by the Ministry of Education, it serves as North Macedonia's official Erasmus+ national coordinator.
Posted by the thegentlemen threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.