The Gentlemen ransomware group has listed the Mandurah State Emergency Service (SES) in Western Australia on its ransomware leak site, claiming to have obtained data from the organisation and threatening to release it.
For more information on The Gentlemen, see our article here.
The listing was first observed on 2 October 2026, with the group reportedly setting a countdown of approximately 215 hours before the data is released. Independent ransomware tracking services have recorded the listing, although at this stage the claim should be treated as unverified.
What makes this listing particularly notable is the nature of the victim. Mandurah SES is a volunteer emergency rescue organisation, rather than a conventional commercial business. The organisation is even described as having no revenue in the ransomware group’s own victim listing.
That raises an uncomfortable question for organisations that still believe ransomware primarily targets companies with significant revenue or the ability to pay a large ransom.
If a volunteer emergency rescue service with no revenue can become a ransomware target, then almost anyone can.
For threat actors operating ransomware-as-a-service models, the target does not necessarily need to be a large corporation. Access to systems, sensitive information, credentials, or data that can be used for extortion may be enough to make an organisation attractive.
Microsoft has described The Gentlemen as a ransomware-as-a-service operation, with affiliates conducting attacks across sectors including education, healthcare, transportation and financial services.
For smaller organisations, charities, community groups and volunteer services, this is an important reminder that being small, non-profit or volunteer-run should never be considered a security control.
The Mandurah SES listing is currently a criminal claim, not confirmation that the alleged data has been stolen or that it will ultimately be released. But regardless of the outcome, the incident highlights a sad reality of the modern threat landscape:
You don’t have to be a big business to be a target.
