Indra Group subsidiary ransomware attack (The Gentlemen)

On 1 July 2026, Indra Group, the Spanish defense, air traffic and information technology company, confirmed that one of its subsidiaries had been hit by a ransomware attack. The confirmation came a day after threat intelligence firm Hackmanac reported that the ransomware gang The Gentlemen had added Indra Group to its data-leak site, starting a countdown of roughly 236 hours (just under ten days) before it would publish or sell the data it claimed to have stolen.

Indra said its security systems detected the attack and that its incident response team (CSIRT) activated containment and analysis protocols immediately. According to the company, the incident had a minimal impact, was confined to a non-critical environment, did not spread to other companies in the group and did not affect operations, with services continuing normally. Indra did not name the affected subsidiary and opened an investigation into the origin of the attack.

What is known about the data

The Gentlemen did not disclose the volume or nature of the data it claimed to hold, and no samples had been published at the time of the company's statement. Indra has not confirmed that any data was taken.

Why it matters

Indra is one of Europe's main defense contractors and a supplier to NATO and Spanish government programs, which makes any intrusion into its corporate perimeter sensitive even when the affected environment is described as non-critical. The Gentlemen, a ransomware operation that emerged in 2025, has been among the most active leak-site operators of 2026, and the case shows that large defense groups remain exposed through subsidiaries with separate IT environments.