"The Gentlemen has become one of the most prolific ransomware groups of recent years and isn’t known for fabricating its claims," said Rebecca Moody, head of data research at Comparitech.
The Gentlemen's claim against MoneyGram
A ransomware group that calls itself The Gentlemen announced today that it had breached MoneyGram, a financial services organization the source describes as having approximately 60 million active customers. The organization itself has not confirmed any incident. The Gentlemen has not published any samples of purportedly stolen MoneyGram data, and no independently verified evidence of a breach was provided in the claim.
MoneyGram's silence and the missing data samples
Security reporting notes that the absence of published data samples "calls into question" The Gentlemen’s claim. That absence leaves a factual gap: there is, at present, no publicly available dataset, file sample, or forensic artifact presented by the group to demonstrate unauthorized access to MoneyGram systems or customer records. The lack of an official statement from MoneyGram compounds the uncertainty about whether its systems, customers, or employees have been affected.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageComparitech’s assessment and the MIP Holdings precedent
Comparitech’s Rebecca Moody urged rapid public communication from MoneyGram, saying the company "needs to issue a statement as soon as possible to either reassure its customers that a breach hasn’t occurred or warn them of any potential unauthorized access to its systems." Moody framed The Gentlemen as an established actor: the group "has claimed 46 attacks on such entities so far this year."
Moody also cited a concrete precedent: an attack on South African technology company MIP Holdings in June 2026. According to the reporting, MIP paid The Gentlemen a ransom intended to secure deletion of stolen data. Despite that payment, The Gentlemen then began targeting MIP’s clients and issuing them their own ransom demand. Moody uses the episode to underline a practical point: paying a ransom does not guarantee stolen data will be deleted.
Why financial organizations are targeted
Moody offered a succinct rationale grounded in the nature of the target set: "Financial organizations are a key target for ransomware groups because of the highly sensitive data they deal with." That combination—sensitive customer information and the scale implied by an organization serving approximately 60 million active customers—was presented as the immediate explanation for why a group like The Gentlemen would single out MoneyGram.
How MoneyGram customers, financial security teams, and MIP's clients should respond
- MoneyGram customers and employees: Moody recommended heightened vigilance. She specifically warned that individual customers "could be contacted by the group" and advised they should be on high alert for potential phishing messages and unauthorized account activity.
- MoneyGram’s security and communications teams: Moody urged the company to issue a public statement promptly to either deny the claim or outline the scope of any unauthorized access, so customers can take informed steps.
- MIP Holdings’ clients and other third-party customers of breached suppliers: The June 2026 MIP incident is presented as evidence that paying a ransom does not necessarily end follow-on extortion. Organizations in a similar position should assume that deletion assurances from a ransomware group may not be reliable.
The immediate factual record is straightforward: The Gentlemen claims a breach of a globally used financial service; MoneyGram has not confirmed it; no data samples have been posted; and Comparitech’s Rebecca Moody considers the claim plausible, pointing to the group’s prior activity and to a June 2026 case in which ransom payment did not prevent subsequent extortion of clients. For now, the practical consequences fall to three groups: MoneyGram must clarify the situation; customers and employees should monitor accounts and communications closely; and any organizations that rely on third-party vendors should revisit assumptions about the finality of ransom payments.
Read the original report: Did MoneyGram Get Hacked? Ransomware Gang Claims It Did — Security Magazine
