Disney Family
bd_4d40e6c60a9a22c4 · schema v1 · pii pii-v1
Full breach record for Disney Family →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Thegentlemen on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
This critical data breach involves Disney Family / Shamrock Holdings, the private investment firm and family office established by Roy E. Disney to manage the wealth of the Disney family branch, rather than the public Walt Disney Company. The compromised dataset, totaling over 800 GB and spanning from the 1980s to June 2026, exposes highly sensitive information across 14 critical categories, including family trusts, tax administration, and private equity fund management. Key victims include prominent figures such as Abigail Disney, Roy P. Disney, and Stanley Gold, whose personal financial records, passports, and KYC documents were leaked alongside detailed trust instruments for the "Disney Grandchildren Trusts." The breach reveals active operational data, including recent payroll records, bank reconciliations with CNB, and subscription agreements for funds like the Shamrock Israel Growth Fund. With unencrypted databases, embedded ERP credentials etc..
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Jun 26, 2026
Claim posted
—
Corroborated · see linked filings
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Ransomware claims (1)
- Leak Sitethegentlemenbd_b1d8affdb7a557722026-07-23 · +27dCandidate
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
thegentlemen
According to ransomware.live, The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.