The Gentlemen lists MoneyGram on leak site without data samples

The listing named MoneyGram alongside KFC, Deloitte and Confluent, National Technology News reported, saying the entries appeared by 10 October and citing the German publication Heise, which said they carried no detail on the type or volume of data allegedly taken. PYMNTS, citing Cybernews, reported on 12 October that the gang said it would publish the data unless MoneyGram began negotiating. None of the four companies had responded to requests for comment, National Technology News said.

Security Magazine noted that no samples of breached data had been published, calling the gang's claim into question. Rebecca Moody, head of data research at Comparitech, said there was still reason to believe it. "The Gentlemen has become one of the most prolific ransomware groups of recent years and isn't known for fabricating its claims," she said.

What MoneyGram customers face

Moody said MoneyGram's customers and employees should be on high alert for phishing messages and unauthorised account activity. She said the company needed to issue a statement quickly, either to reassure customers that no breach occurred or to warn them of unauthorised access.

She also warned that paying does not buy deletion. Moody said the gang hit South African tech company MIP Holdings in June 2026, that MIP paid to have the stolen data deleted, and that The Gentlemen has since begun sending MIP's clients their own ransom demands. "Regardless of whether or not negotiations are successful, individual customers could be contacted by the group," she said.

Why a payments company draws this group

Moody said financial organisations are a major target because they handle highly sensitive data. She said The Gentlemen has claimed 46 attacks on such entities so far this year. Comparitech counted 202 claims by the gang last quarter, second only to Qilin's 353, Dark Reading reported.

BleepingComputer reported that the gang has publicly claimed around 320 victims since it emerged around mid-2025, most of the attacks occurring this year. ESET dates the gang's emergence to late 2025. NCC Group's Dillon Ashmore told Dark Reading that The Gentlemen passed 150 victims in nine months, where DragonForce took almost two years. The counts come from separate trackers and cover different periods.

The gang behind the claim

The Gentlemen runs ransomware-as-a-service, letting affiliates use its infrastructure to break in and encrypt. It uses double extortion, encrypting data and threatening to leak it if the ransom is not paid. ESET found the gang takes a 10% cut of ransom payments and gives affiliates 90%, compared with an industry standard operator cut of 20%.

ESET said the gang's victims cluster in Southeast Asia, South America and Western Europe rather than the United States. ESET said the group was reportedly formed by a disgruntled former Qilin affiliate, following a reported dispute over unpaid commissions in 2025.

What is unverified about the claim

The scope of any compromise is unknown. Nothing published so far establishes which systems were affected, how attackers would have gained access, or whether customer or financial data was taken. MoneyGram reported a separate incident in September 2024, when it had a network outage and said it found a "cybersecurity issue."