MoneyGram ransomware claim: Gentlemen gang threatens data leak

01 The Gentlemen ransomware gang claims it attacked MoneyGram and threatens to publish stolen data.

02 MoneyGram has not confirmed an incident, and the attackers have not shared data samples.

03 MoneyGram serves 60 million active customers across more than 200 countries.

04 Researchers link The Gentlemen to experienced ransomware operators who pressure victims by threatening to leak data.

Key Takeaways by nexos.ai , reviewed by Cybernews staff.

The Gentlemen ransomware gang has claimed an attack on MoneyGram, one of the world's largest payment networks, and is threatening to release the stolen data.

The notice of the alleged breach came up on October 12th on the gang’s leak site on the dark net. The attackers have not released any data samples to support their claims.

Attackers gave the company a little bit over a week to start negotiating. So far, there is no confirmation from the company if a cyber incident took place and what data may be involved.

Headquartered in Dallas, Texas, the company’s operations span over 200 countries and serve around 60 million active customers. The scope of the alleged breach is unknown at this time. However, such a huge customer base may pose major risks.

"Since MoneyGram is a company that handles money transfers, the data that the gang allegedly obtained could contain sensitive personal or financial user information," said Cybernews researchers. " This kind of info is really monetizable on the dark web, also there could be risks of financial fraud and social engineering campaigns targeting the users," they added.

Cybernews has reached out to the company for , and we will update this article once we receive a response.

If the current claims prove legitimate, it will not be the first breach the company has experienced.

In 2024, MoneyGram suffered a cyberattack, reportedly via social engineering, targeting its IT help desk.

The attack knocked out its systems for 5 days and resulted in the theft of customer personal data , including names, Social Security numbers, government IDs, and transaction records.

Check if your data was exposed

Find out if your email and related personal information have appeared in known data breaches.

What do we know The Gentlemen?

Researchers at ASEC, South Korean cybersecurity firm AhnLab’s threat intelligence and research division , are convinced that the Gentlemen gang’s technical sophistication suggests a coordinated team with extensive experience in enterprise-focused attacks.

The gang relies on ransomware-as-a-service (RaaS) to profit and employs a double-extortion model. It splits revenue with affiliates who use its illicit infrastructure.

The Gentlemen originated as ArmCorp, a prolific affiliate cluster of the Qilin ransomware program, comprising approximately 20 members.

According to Halcyon security firm , the split between the gangs was triggered by a payment dispute on July 2nd, 2025, when the threat actor known as "hastalamuerte" filed a public arbitration complaint on the RAMP underground forum, alleging that Qilin owed roughly $48,000 in unpaid commission.

The first Gentlemen ransomware sample appeared on VirusTotal on July 17th, 2025. This was 5 days before the public dispute, with the leak site URL already hardcoded into the binary, indicating the separation was premeditated and already underway.

The gang has listed quite a number of victims recently, including NATO contractor Indra , European data exchange platform FTAPI , Dutch ice arena Thialf , LA Metro , and Glassdoor .

Fintech platforms are a prime target for cybercriminals

Fintech platforms have been an attractive target for cybercriminals, as they handle money and a treasure trove of personal data.

A successful breach can give attackers several ways to make money, from stealing funds and selling personal data to extorting the company with threats to expose sensitive records.

This year, UK-based fintech giant Revolut suffered a data breach when fraudsters impersonated an Italian government agency to extract customer data.

At the beginning of the year, PayPal notified its customers that an attacker had lurked undetected inside its systems for roughly 6 months before being discovered.

The incident, tied to PayPal's Working Capital app, exposed customers' Social Security numbers and other sensitive data.

In August, hackers claimed Stripe as a victim. Customer information allegedly tied to Stripe surfaced on a cybercrime forum, raising concerns that criminals could build detailed shopper profiles for phishing. Our researchers also flagged exposed API keys that could let attackers access accounts, create charges, or issue refunds.

Last year, the Everest ransomware group claimed an attack on check-cashing and short-term loan chain Money Mart . The attackers allegedly stole customer transaction records, credit card details, and employee personal information.