The Gentlemen ransomware-as-a-service (RaaS) operation has added MoneyGram to its dark web leak site and is threatening to publish data it says it stole. MoneyGram is a Dallas-based money-transfer firm that serves about 60 million active customers in more than 200 countries. This incident is not confirmed. MoneyGram has not commented publicly, no regulator filing or company notification exists, and the gang has released no data samples. Every outlet that covered the listing (Cybernews, heise, TechNadu, RecentBreaches, vpn.social) calls it an unverified claim. The only PRIMARY-tier source available is Sophos threat research on the gang itself. Nothing at that tier speaks to MoneyGram's case. Readers should treat this as an extortion claim, not an established breach.
What Happened
The Gentlemen posted MoneyGram on the same leak site it uses for its double-extortion campaign. Sources give slightly different dates:
- October 11, 2026: RecentBreaches says MoneyGram was listed on this date.
- October 12, 2026: Cybernews, TechNadu (citing the Ransomware.live tracker) and CyberThreatIntelligence.net put the listing here.
- October 10, 2026: QPulse reports an "estimated attack date" here, citing Ransomware.live. No other source repeats it.
The gang set a deadline for MoneyGram to start negotiating. Cybernews describes it as "a little bit over a week," and TechNadu puts it at about nine days. No ransom amount has been published.
MoneyGram appeared in a batch with other well-known names. heise reports that the leak site also lists Confluent, Deloitte and KFC. TechNadu notes that Ransomware.live logged Deloitte on October 9, three days before KFC and MoneyGram, and heise saw that Deloitte's countdown was about 40 hours ahead of the others.
The gang's recent history gives mixed signals about how reliable its claims are:
- FTAPI: The gang had already published files it said it took from the German secure file-transfer vendor. FTAPI had earlier admitted a breach of a single local server, and vpn.social describes this claim as "borne out."
- Air Canada: heise says the gang has also published what look like OneDrive dumps attributed to Air Canada. The airline has not confirmed a breach.
If this claim holds up, it would not be MoneyGram's first serious incident. Cybernews recalls a 2024 cyberattack on the company, reportedly carried out by social engineering of its IT help desk.
What Was Taken
We don't know. The listing does not say what data was taken, how much, which systems were involved, or how the attackers got in. heise, TechNadu and RecentBreaches all confirm this.
According to RecentBreaches, the listing text describes only the business: the moneygram.com domain, revenue, and transfer volume. Even that profile data varies between sources:
- Revenue: about $1.24 billion according to RecentBreaches (quoting the listing), versus $2.1 billion according to CyberThreatIntelligence.net (from Ransomware.live).
- Transfer volume: both describe a network moving nearly $200 billion a year.
These differences come from third-party scraping of the listing, not from MoneyGram, and neither figure should be read as authoritative.
The risk comes from what a money transmitter holds. Cybernews researchers warn that any stolen data could include sensitive personal or financial information on senders and recipients. That kind of data sells easily on criminal markets and could feed fraud and social engineering. This is a judgement about possible exposure. Nobody has evidence of what, if anything, was taken.
Why It Matters
The actor is high-volume and growing fast. Sophos Counter Threat Unit tracks the operator as GOLD SHERWOOD. According to Sophos:
- The RaaS launched in mid-2025, and the first victims were posted in September 2025.
- It recruited affiliates on the RAMP forum with an unusually generous 90/10 revenue split.
- Monthly postings rose from fewer than 20 in late 2025 to an average of over 75 in early 2026.
- By the end of July 2026 the leak site listed 683 victims, including 169 in July alone, which made it the most active leak site that month.
Lower-tier trackers give higher and inconsistent totals. CyberThreatIntelligence.net shows 1,040 victims listed on one page and 922 "since February 2023" on another. The 2023 date conflicts with Sophos's mid-2025 launch. The same site also cites a compromised C2 server that reportedly exposed more than 1,570 linked victims. We give Sophos's figure the most weight.
Victim selection is opportunistic. Sophos describes the gang's victims as typical of an opportunistic criminal enterprise that targets whatever access it can get, across many sectors. That means a listing tells you little about whether a specific intrusion was deliberate or how deep it went.
MoneyGram is a high-impact target. It is a licensed money transmitter with more than 75 regulatory approvals, and a large share of its transactions are digital. It also runs a recently launched stablecoin and card product. Any confirmed exposure would bring regulatory notification duties in many jurisdictions and a long period of follow-on fraud risk for customers.
Listings are pressure tools. As vpn.social notes, a listing can reflect a real intrusion, an exaggerated one, or nothing at all. The absence of samples does not disprove the claim, but it does mean no outside party can verify it yet.
The Attack Technique
How the attackers got into MoneyGram, if they did, is unknown. No source has a confirmed entry vector.
QPulse (OTHER tier) links the listing to infostealer activity involving the "Cavalier" stealer family, citing HudsonRock intelligence and a ParanoidLab exposure report. That report describes:
- 198,771 harvested passwords, 445 of them marked critical
- 44,507 cookies, 64 of them marked critical
- 5 compromised employees, 42,454 compromised users, and 8 third-party employee credentials
- MoneyGram's SaaS footprint: Atlassian, DocuSign, GlobalSign, Jamf, Microsoft 365, Proofpoint and Slack
These figures describe MoneyGram's overall credential exposure from stealer logs. They are not a record count from this incident, and only one OTHER-tier source draws the link. They show possible routes in, not proof of how the attackers entered.
Sophos's analysis of 15 Gentlemen intrusions describes a consistent affiliate playbook:
- Initial access through exposed remote access services and compromised credentials, which matches the Valid Accounts (T1078) technique that CyberThreatIntelligence.net maps to the group.
- Rapid privilege escalation and adaptive use of legitimate admin tools to blend in.
- Aggressive defense evasion before deployment.
- Data staging and exfiltration before encryption, the double-extortion model.
- Encryption sometimes within 24 hours of the first post-compromise activity.
CyberThreatIntelligence.net adds that the gang's locker is written in Go and targets Windows, Linux, NAS and BSD systems.
What Organizations Should Do
- Rotate exposed credentials and kill exposed sessions. Check stealer-log feeds for your domains. Revoke session tokens and reset passwords for any employee, contractor or third-party account that appears, with priority on SSO, Microsoft 365, Slack and Atlassian.
- Harden remote access and enforce phishing-resistant MFA. Sophos names exposed remote access services and stolen credentials as the main entry points. Make MFA mandatory on VPN, RDP gateways and SaaS admin consoles, and prefer FIDO2 over push or SMS.
- Lock down help desk identity verification. MoneyGram's 2024 incident reportedly started with help desk social engineering. Require out-of-band verification before any password or MFA reset, especially for privileged users.
- Monitor for fast privilege escalation and admin tool abuse. With ransomware sometimes deployed within 24 hours, alert on new domain admin grants, unusual use of remote management tools, and attempts to disable security tooling.
- Detect staging and exfiltration. Watch for archive creation in unusual directories, large outbound transfers, and use of cloud-sync or file-transfer utilities that are not part of normal workflows.
- For MoneyGram customers and partners: Until the company confirms or denies the claim, watch accounts for unusual activity. Expect phishing that uses the MoneyGram name. Verify any "breach notification" or refund offer through official channels before acting on it.
Sources: MoneyGram ransomware claim: Gentlemen gang threatens data leak Cyb... | Ungentlemanly behavior: Insights into a ransomware operation SOPHOS | Cybercriminals claim data leak at Confluent, Deloitte, KFC and Mone... | The Gentlemen Group Claims MoneyGram, Deloitte, KFC Breaches - Tech... | Thegentlemen Ransomware Group Claims MoneyGram as Victim Following... | MoneyGram Ransomware Claim (2026) — What’s Alleged & Am I Affected? | Gentlemen Ransomware Lists MoneyGram, Deloitte, KFC Claims — vpn.so... | MoneyGram Ransomware Attack by Thegentlemen (2026) Cyber Threat In...