Thialf, the renowned ice arena in Heerenveen, Netherlands, has been targeted in a cyberattack, with the ransomware group behind the intrusion threatening to release stolen data on the dark web unless it receives payment within days.
Thialf serves as the home base for the Dutch national speed skating team and hosts long-track and short-track speed skating, figure skating and ice hockey. The venue was recently confirmed as the long-track speed skating site for the 2030 Winter Olympics, marking the first time part of the Winter Games will be held in the Netherlands.
In a public statement, Thialf described the incident as a cyberattack with minimal impact and said a forensic investigation involving internal and external security experts found that its data and operational processes were not compromised. The venue said all directly involved parties were kept informed throughout the investigation and that scheduled events can proceed as planned for now.
According to RTL Nieuws, however, the attackers are demanding a ransom to restore access to Thialf’s computer systems and to prevent the release of stolen data. A Thialf spokesperson confirmed to the broadcaster that the venue was attacked and is in discussions with the perpetrators, though the spokesperson said no further details could be shared. The amount of the ransom demand is not known.
A group calling itself The Gentlemen, also tracked as Storm-2697, has claimed responsibility for the attack. The cybercriminals say they obtained internal documents, employee information, financial contracts and other sensitive material. Per RTL Nieuws’ reporting, Thialf is the group’s eighth known victim in the Netherlands, following earlier attacks on the Institute for the Dutch Language and a construction company.
The Gentlemen has been active since the summer of 2025 and initially operated as a closed ransomware group before launching a ransomware-as-a-service platform for affiliates in September 2025, according to Microsoft. The company said the group later formed a partnership with BreachForums to recruit affiliates, including penetration testers and initial access brokers.
Microsoft, which issued a warning about the group in May 2026, said The Gentlemen is financially motivated and relies on double extortion, encrypting victims’ data while also exfiltrating sensitive files to pressure them with the threat of public exposure if a ransom goes unpaid. Cybersecurity firms Group-IB and Palo Alto Networks have said the group exploits known vulnerabilities in Fortinet FortiOS, the Erlang/OTP SSH server, Windows SMB and the React2Shell vulnerability.
