Extortion without encryption leaves the operations line clean. Nutex says it has identified no material impact on its business operations or financial reporting systems to date [7], which is the signature of a theft-only intrusion: nothing stops, and the loss sits entirely in copies that are already off the network. The contrast inside the same gang's victim list is AnMed, the nonprofit medical system whose IT The Gentlemen shut down and whose Facebook account it took over, forcing dozens of facilities to close for several days before AnMed confirmed patient information was stolen [21]. One operator, two very different outage profiles.
Scale sets the notification problem. Nutex runs 27 hospital and outpatient facilities in 12 states and booked $427.2m in the first half of 2026 [19], and it reportedly served nearly 100,000 patients over that same period [20]. If the files taken from its servers track recent care, the letter population is a six-figure exercise, and it cannot begin until the review names individuals.
On the actor, the public record is two different tallies. The Record reports The Gentlemen operating since September 2025 with at least 350 attacks [15]. SecurityWeek dates emergence to mid-2025 and counts more than 580 victims in over 75 countries [16]. Subtract and the gap is 230 victims for the same ransomware-as-a-service brand [17], which is what happens when leak-site posts stand in for a census. The Record also reports experts assessing the group as a spinoff run by a disgruntled former Qilin affiliate, with Russian operators inferred from its ban on targeting CIS countries and its Russian-language forum posts [18]. That is assessment, not confirmation, and Nutex's filing names no group at all [24].
The defensive read comes from Sophos, which published on September 1 that healthcare accounts for 9% of The Gentlemen's victims, second to manufacturing at 10%, and that affiliates typically gain initial access by exploiting firewall vulnerabilities and abusing VPN services [12][13]. No one has published the entry point at Nutex, so internet-facing security appliances and remote access accounts are the working hypothesis rather than a finding. Gambit Security separately reported seeing a Gentlemen affiliate using Claude Code during intrusions at six or more organizations [23].
For hospital groups the sequence Nutex just ran is the one to plan against: an 8-K on detection, a class action three days later, a leak-site countdown, and patient letters last.
