SAP Latin America hack by The Gentlemen: what is known and what to do
A ransomware group claims to have compromised SAP's regional subsidiary. So far it is a claim made by the group itself, with no independent verification and no official statement from SAP.
Status of the information
Updated October 30, 2026- Known
- The listing exists. Several threat monitors report that the group The Gentlemen posted SAP Latin America and Caribbean on its leak site, dated October 26, 2026 (UTC).
- Unverified
- Whether the attack took place, what information may have been obtained and whether it is authentic. All of it rests on the group's word.
- No statement
- As of today, SAP has not issued any official communication confirming an incident.
Who the listing refers to
The listing names SAP Latin America and Caribbean, the regional subsidiary of SAP SE, which operates in about 10 countries across the region. The group's listing does not mention customer systems or RISE with SAP environments, and for now there is no confirmed information about what might be involved.
What the listing names
SAP Latin America and Caribbean
Regional subsidiary of SAP SE, operating in about 10 countries.
What the listing does not mention
Customer systems and environments
Including RISE with SAP environments.
It is best not to assume that a claim about SAP's regional organization involves customer systems, and equally not to assume the opposite. With the information available, either conclusion would be premature.
What SAP has said
SAP has established protocols and a dedicated team for responding to security incidents. As of publication, it has not issued any official communication confirming an incident.
For formal security requests, the appropriate channel is SAP's security support team, through the SAP Trust Center.
Why caution is warranted
A listing on a leak site is, by definition, a claim made by the attacker. It is used to pressure the victim and to draw attention, but on its own it does not show that the attack happened or what was obtained. Until SAP confirms or there is independent verification, the responsible approach is to treat it for what it is: an unverified claim.
What you can do in the meantime
Use the formal channel. If your company needs to make a security request to SAP, do it through the SAP Trust Center, not through social media comments or messages you did not ask for.
Be wary of messages that exploit the news. When a topic like this becomes public, it is common for emails or messages to appear impersonating whoever is at the center of the story. Check the sender and the links before acting, and report anything suspicious to your security team.
Confirm your designated contact. Make sure your team knows who the designated contact is for receiving SAP security communications, and that the information is up to date.
Sources consulted
- Dark Web Intelligence, post on X about The Gentlemen listing.
- VenariX, post on X about the same listing.
- SOCRadar, listing record with "Claimed" status.
- SAP Trust Center, security incident management.
We will update this article if SAP issues an official statement or if verifiable information appears.
If you would like to calmly review how your team handles communication with SAP on security topics, let's talk.