The Gentlemen ransomware group has struck another Australian victim, this time listing Western Australia’s Mandurah State Emergency Service unit on its darknet leak site.
Mandurah SES has confirmed it is responding to the incident, after it was informed by state government authorities.
“The Office of Digital Government’s (DGov) WA Cyber Security Operations (WASOC) provided notification on 5 October 2026 that Mandurah SES had experienced a cyber security incident involving unauthorised access to one of its servers,” a spokesperson for the unit told Cyber Daily.
The impacted server held only historical records prior to 2022, however, and there is “no evidence” that any other systems were impacted.
Mandurah SES operations continue as normal and are unaffected.
“An investigation, supported by the Office of Digital Government’s (DGov) WA Cyber Security Operations Centre (WASOC), is determining the extent of the cyber security incident,” the unit spokesperson said.
Mandurah SES is also aware that further data has been published online as of October 13.
“Mandurah SES has been contacting past and present members impacted by the incident and, with the guidance of DGoV, has provided advice on what they can do to protect their personal information,” the spokesperson said.
“The Department of Fire and Emergency Services (DFES) is providing support to the Mandurah SES as it manages this incident.”
The data published on the darkweb includes several .zip files of compressed backups, and a further backup folder containing historical operations and planning data.
Who is The Gentlemen?
The group only appeared on the ransomware scene in September 2025; however, in that time, The Gentlemen has risen to the number-two spot in terms of victim count, behind only the Qilin ransomware-as-a-service operation.
The group is thought to be made up of Russian speakers and operates under a similar model to Qilin – affiliates keep 90 per cent of any ransom paid, with the rest going to The Gentlemen in return for using its infrastructure and malware.
The Gentlemen’s most recent Australian victim was Charters Towers-based All Souls St Gabriels School, which confirmed this week it was responding to a cyber incident caused by the hackers.
What is Mandurah SES?
The unit operates under the WA State Emergency Service and is a “volunteer organisation that assists the community in land & air searches, storm damage operations, flood relief, cliff & cave rescue, and cyclone and earthquake operations”.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
