VULNpocalypse
LowBreach / campaignMonitoring

The Gentlemen ransomware group claims MegChem on its leak site

The Gentlemen ransomware group claims MegChem on its leak site, per RansomLook, but it is unconfirmed, so partners should watch for official notice.

Published
Exploitation
No, not confirmed: the only evidence is a leak-site listing recorded by a claim tracker

What happened

The Gentlemen ransomware group claims MegChem as a victim on its leak site, according to the claim tracker RansomLook. RansomLook shows the post dated 2026-11-02 under the title “MegChem” with the domain megchem.com.

The group’s listing describes MegChem as a South African engineering consultancy based in Secunda, Mpumalanga. According to the listing, it serves the petrochemical, oil and gas, energy and mining sectors (RansomLook). This description comes from the group’s post. It is not a verified profile.

What is not confirmed:

  • MegChem has not confirmed an incident in the provided sources.
  • No independent outlet has verified the claim. The only source is a claim tracker.
  • The listing as captured does not state a data volume, data types or an entry point for MegChem. These details are not confirmed.
  • Whether any data was taken or systems were encrypted is not confirmed.

Am I affected?

Not confirmed. The sources name no affected products, software, customers or partners. They also give no technical details that would let anyone check their exposure.

What to do now

  1. If you are a MegChem client or partner, watch for an official statement or notification from MegChem.
  2. If you contact MegChem about this, use contact details you already trust. Do not use details found in any leak-site post.
  3. Treat the listing as an unverified claim until MegChem or an independent source confirms it.

Sources