All ransomware incidents
Ransomware group thegentlemen hits United Pharmacy
United Pharmacy — a healthcare target operating in SA has been listed by the thegentlemen ransomware group on 2026-11-11. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | United Pharmacy |
|---|---|
| Threat Group | thegentlemen |
| Summary | United Pharmacy, a healthcare organization in Saudi Arabia, was listed by the thegentlemen ransomware group on its leak site on 2026-11-12. |
| Date of Breach | 2026-11-11 |
| Discovery Date | 2026-11-12 |
| Region | SA |
| Target Domain | unitedpharmacy.sa |
| Business Sector | Healthcare |
| Severity | MEDIUM |
Claim by thegentlemen
unitedpharmacy.sa United Pharmaceuticals Company is Saudi Arabia's third largest pharmacy chain, founded in 1990 in Jeddah by Sheikh Dr. Mohammed Al Yassin, with 450 plus branches across 80 cities and over 1,100 employees in 8 countries. It holds a 10 percent market share and targets 15 percent by 2027 through aggressive expansion, including the SAR 100 million acquisition of Kunooz Pharmacies in February 2026 and plans to open 100 new branches this year. Led by CEO Khalid Yassin since January 2024, it was awarded Great Place to Work in Saudi Arabia in 2024 and 2025. Its mobile app has 656K installs with a 4.71 star rating and offers cash on delivery, Tamara installment plans and insurance prescription dispensing. Strategic MoUs with Sudair Pharma and PPI Company aim to expand access to innovative medicines. The company competes with Nahdi (1,207 stores) and Al Dawaa (954 stores) but grows fastest among the top three.
Posted by the thegentlemen threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.