[Single source] Claim: The Gentlemen lists North Macedonia's Erasmus+ agency

DailyDarkWeb reports that The Gentlemen ransomware group listed North Macedonia's National Agency for European Educational Programmes and Mobility on its leak site. The supplied evidence does not confirm a breach: no stolen-data samples, file count or data volume were presented, and the agency had not publicly confirmed an incident when the post was published.[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list

According to DailyDarkWeb, the alleged listing names the government body in Skopje that administers Erasmus+ and the European Solidarity Corps in North Macedonia. This establishes a public claim attributed to the ransomware group, not proof that its systems were accessed or data was stolen.[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list

If the claim proves genuine, the incident could affect sensitive material connected to education programs, including applicant information, participant records and grant files. That potential impact follows from the agency's reported responsibilities, but the evidence does not show that any particular record was exposed.[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list

Treat the leak-site appearance as an unverified warning rather than a confirmed breach. Students, schools and partner organizations should watch for official agency guidance and be cautious with unexpected messages about Erasmus+, grants or participant accounts, especially while the scope remains unknown.[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list

The supplied post identifies the alleged victim and says a leak-site listing exists. It also explicitly says the listing contains no sample, file count, data size or description of the purportedly taken records. There is no independent verification or public confirmation from the agency in the evidence provided.[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list

DailyDarkWeb warns readers not to treat the threat actor's claim as confirmation of a breach. Its analyst note says the agency handles applications, evaluations and participant records for thousands of students, schools and organizations, making a genuine compromise potentially consequential.[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list

The evidence trail currently begins with DailyDarkWeb's report of the leak-site listing. No subsequent agency statement, technical investigation, data sample or independent corroboration is included, so the story has not progressed beyond an attributed ransomware claim in this evidence set.[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list

1 independent groups, 1 updates, and 0 engagements.

No technical indicators are available in the supplied evidence. The report provides no attack vector, malware behavior, affected systems, intrusion date, encryption status, ransom demand, file inventory or sample that investigators could use to validate the claim.[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list

The evidence set contains a single DailyDarkWeb post on X, accompanied by an HTTPS-hosted image. It is a secondary report about an alleged threat-actor listing, not a statement from the agency, a forensic report or independently authenticated leaked material.[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list