VULNpocalypse
LowBreach / campaignMonitoring

Customs Support: The Gentlemen ransomware group claims attack on leak site

The Gentlemen ransomware group lists Customs Support on its leak site, per RansomLook; unconfirmed, so customers should watch for official notices.

Published
Exploitation
No, no confirmed intrusion; RansomLook only records a leak-site listing by the group

What happened

The Gentlemen ransomware group claims Customs Support as a victim on its leak site, according to the claim tracker RansomLook. RansomLook records the post on 2026-11-02 under the title “Customs Support” with the domain customssupport.com.

The listing’s description presents Customs Support as a customs brokerage network headquartered in the Netherlands. It names a German subsidiary, IZD GmbH, based in Duisburg, according to the text captured by RansomLook. The listing’s text comes from the group’s post, so its descriptions are not verified facts.

The following is not confirmed:

  • Customs Support has not confirmed an incident in the provided sources.
  • No independent outlet has verified the claim.
  • The entry point, the timing of any intrusion and whether any data was taken are not confirmed.
  • The listing does not state a data volume.

Am I affected?

Not confirmed. The sources do not say which systems, data or customers are involved, if any. If you are a Customs Support client or partner, your exposure is unknown until the company says more.

What to do now

  1. Watch for an official notice from Customs Support or IZD GmbH before acting on the claim.
  2. If you are a client, ask your Customs Support contact whether your data is in scope. This is a general precaution, not something the sources state.
  3. Be cautious with unexpected messages that reference this claim or ask for payment or credential changes. This is also a general precaution, not sourced.
  4. Check back for updates. This advisory will change if the company or an independent outlet reports more.

Sources