NATO contractor Indra suffers data breach

One of Europe's biggest defense contractors is racing against a ransomware countdown after hackers threatened to publish allegedly stolen data.

The Gentlemen ransomware gang has listed one of Europe’s defense powerhouses – the Spanish multinational company and NATO contractor, the Indra Group.

So far, it is unknown what kind of data is involved in the alleged data breach. The gang released a post on June 30th on its leak site on the dark web, setting the deadline for the company to start communication.

The gang put Indra Group on a countdown before the data is publicly released. This is a common tactic ransomware gangs use to threaten victims and pressure them into paying the ransom.

As reported in local media, Indra has confirmed a ransomware attack that affected one of its subsidiaries but has "guaranteed the security and continuity of its services."

As the company explained, at the moment the ransomware was detected, its Computer Security Incident Response Team activated the internal protocols provided for analysis, verification, and security review in the environments that could have been compromised "immediately."

The company has assessed that the attack was localized and the risk of spread across the group’s subsidiaries has been “ruled out.” According to the company, the investigation is still ongoing, as well as an audit of security procedures and controls.

In a press release shared later with Cybernews, Indra Group stated that a "minimal-impact cybersecurity incident" affected its subsidiary. However, it ensured that the
subsidiary's activities continued without interruptions. "The incident was minimal and limited to a non-critical environment," the company stated.

"Indra Group is continuing to conduct a thorough investigation to determine the origin of the cyberattack, while reviewing and reinforcing its cybersecurity controls and procedures with the aim of bolstering information security and the continuity of the service to its customers," the press release read.

European defense powerhouse

Headquartered in Spain, Indra Group is one of Europe's largest defense, aerospace, and technology companies, providing critical systems to governments, militaries, and operators of essential infrastructure worldwide. It is the first Spanish company to join NATO's cyberdefence coalition.

Indra also supplies identity management and cybersecurity solutions protecting sectors such as energy, finance, telecommunications, and public administration.

Indra is a global supplier of air traffic management technology, developing civil and military systems, including surveillance radars, flight data processing platforms, and military simulation systems.

The company's space business expanded significantly in 2025 after acquiring approximately 90% of Spanish satellite operator Hispasat, strengthening its presence in satellite communications and space technologies.

Indra also develops intelligent transportation systems used to manage roads, railways, and other critical mobility infrastructure.

The company has over 62,000 employees worldwide. With the annual revenues reaching €5 billion, the company operates in over 140 countries.

What do we know about Gentlemen?

Gentlemen’s business model is straightforward – the gang relies on ransomware-as-a-service (RaaS) to profit. They split revenue with affiliates who their illicit infrastructure.

Gentlemen originated as ArmCorp, a prolific affiliate cluster of the Qilin ransomware program, comprising approximately 20 members.

According to Halcyon security firm, the split between the gangs was triggered by a payment dispute on July 2nd 2025, when the threat actor known as "hastalamuerte" filed a public arbitration complaint on the RAMP underground forum, alleging Qilin owed roughly $48,000 in unpaid commission.

The first Gentlemen ransomware sample appeared on VirusTotal on July 17th 2025. It is five days before the public dispute, with the leak site URL already hardcoded into the binary, indicating the separation was premeditated and already underway.

Thailand is the gang’s most targeted country with 27 victims, followed by the United States, France, and Brazil.

Unlock more exclusive Cybernews content on YouTube.