The Gentlemen Claims Breach of MoneyGram, Cites 46 Financial Targets This Year
Ransomware group The Gentlemen asserts it accessed MoneyGram systems, though the payment firm has not confirmed the incident or released any stolen data samples for verification.
Key points
- The Gentlemen ransomware group claims to have breached MoneyGram, a financial services provider with 60 million active customers.
- MoneyGram has not confirmed the incident, and no data samples have been published by the attackers to substantiate the claim.
- The group has targeted 46 financial entities this year and is known for not fabricating breach claims, according to Comparitech research.
The Gentlemen ransomware group asserts it has breached MoneyGram, a global financial services organization with approximately 60 million active customers. The payment transfer company has not publicly confirmed that an incident occurred. No samples of allegedly stolen data have been released by the attackers, leaving the extent of any potential compromise unverified by independent observers.
What evidence supports the breach claim?
No data samples or technical proof have been published by The Gentlemen to substantiate their assertion that they accessed MoneyGram’s systems. This lack of evidence typically raises skepticism about the validity of such claims. However, Comparitech Head of Data Research Rebecca Moody suggests the allegation may be legitimate based on the group’s historical behavior. She notes that The Gentlemen is not known for fabricating breach claims.
Why is MoneyGram a likely target?
Financial organizations hold highly sensitive customer data, making them prime targets for ransomware operators. The Gentlemen has claimed 46 attacks on financial entities so far this year, indicating a focused campaign against this sector. The group’s track record includes successful intrusions into companies that handle significant volumes of personal and financial information, which increases the potential impact of a breach on institutions like MoneyGram.
What is the threat actor’s recent behavior?
The Gentlemen recently attacked MIP Holdings, a South African tech company, in June 2026. MIP Holdings paid a ransom to The Gentlemen to ensure the deletion of stolen data. Despite this payment, the group has begun targeting MIP Holdings’ clients directly with their own ransom demands. This pattern suggests that paying a ransom does not guarantee data deletion and that the group may retain copies for secondary extortion efforts.
What should customers and employees do?
Regardless of whether MoneyGram negotiates with the attackers, individual customers and employees could be contacted directly by The Gentlemen. Rebecca Moody advises that both groups should remain on high alert for potential phishing messages. Users should also monitor for unauthorized account activity. MoneyGram needs to issue a statement soon to either reassure customers that no breach occurred or warn them of potential unauthorized access to their systems.
Background: Ransomware
Isolate the infected machine from the network immediately. Do not reboot it, as this destroys volatile memory evidence. Identify the scope of the attack. Restore data only from verified, offline backups. Reset all credentials. Analyze logs to determine how the attacker entered. Update defenses based on findings.
Read the full guide: Ransomware Response: Steps to Contain, Recover, and Prevent Recurrence
What to do and how to stay safe: MoneyGram
- Monitor your MoneyGram account statements and transaction history daily for any unfamiliar or unauthorized transfers or changes to personal information.
- Scrutinize all incoming emails and messages claiming to be from MoneyGram or related security entities, looking for signs of phishing such as urgent language or suspicious links.
- Enable two-factor authentication on your financial accounts if it is not already active, adding an extra layer of security against credential theft.
- Keep personal contact information private and be wary of unsolicited communications from unknown sources that might reference recent security incidents.
Step-by-step guide: 7 Phishing Mistakes That Bypass Your Defenses
General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Has MoneyGram confirmed that The Gentlemen breached its systems?
No, MoneyGram has not confirmed the incident, and the ransomware group has not published any data samples to prove the breach occurred.
How many financial organizations has The Gentlemen targeted this year?
The Gentlemen has claimed 46 attacks on financial entities so far this year, according to research by Comparitech.
Did paying a ransom help MIP Holdings avoid further issues?
No, despite paying a ransom to delete stolen data, MIP Holdings found that The Gentlemen began targeting its clients with separate ransom demands.
