The Gentlemen Claims MoneyGram Breach, But No Data Samples Published Yet

The Gentlemen ransomware group claims to have breached MoneyGram, a global financial services provider with approximately 60 million active customers. The group made this assertion today, but MoneyGram has not confirmed that an incident occurred. No samples of breached data have been published by the attackers, which casts doubt on the validity of the claim according to the reporting.

Despite the lack of evidence, experts suggest the claim warrants attention. Comparitech Head of Data Research Rebecca Moody noted that The Gentlemen is one of the most prolific ransomware groups in recent years and is not known for fabricating claims. She stated that MoneyGram needs to issue a statement quickly to either reassure customers that no breach occurred or warn them of potential unauthorized access to its systems.

Context on the Threat Actor

Financial organizations are key targets for ransomware groups because they handle highly sensitive data. According to Security Magazine, The Gentlemen has claimed 46 attacks on such entities so far this year. The group’s track record includes a notable attack on South African tech company MIP Holdings in June 2026. In that case, MIP Holdings paid a ransom to The Gentlemen to delete the stolen data.

However, the outcome of the MIP Holdings incident highlights the risks of paying ransoms. After receiving payment, The Gentlemen began targeting MIP Holdings’ clients directly, issuing them with their own ransom demands. This behavior serves as a reminder that paying a ransomware group does not guarantee that stolen data will be deleted or that the attackers will cease operations against the victim’s ecosystem.

Who Is Affected

In the case of MoneyGram, the situation remains unconfirmed. Regardless of whether negotiations between the company and the ransomware group are successful, individual customers could be contacted by the group directly. This possibility suggests that customers and employees should remain on high alert for potential phishing messages and unauthorized account activity.

The Gentlemen’s pattern of targeting clients after a primary breach indicates that third parties may also face risks. If MoneyGram was indeed breached, its partners and customers could receive communications from the attackers. Until MoneyGram provides an official update, stakeholders should monitor their inboxes and account statements for any unusual activity.

What should you do?

Security professionals and customers should monitor official channels for statements from MoneyGram. Since no fix has been confirmed yet, organizations relying on MoneyGram services should review their access logs for anomalies. Individuals should check their accounts for unauthorized transactions.

What to do and how to stay safe: MoneyGram

• Monitor official communications from MoneyGram for any confirmation of a breach or security incident.
• Check financial accounts regularly for unauthorized transactions or unusual activity that may indicate compromise.
• Be vigilant against phishing emails that claim to be from MoneyGram or the attackers, especially those requesting credentials.
• Enable multi-factor authentication on all financial accounts to add a layer of protection against credential theft.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Has MoneyGram confirmed that it was hacked?

No, MoneyGram has not confirmed the incident, and no data samples have been published to verify the claim.

Who is The Gentlemen?

The Gentlemen is a prolific ransomware group that has claimed 46 attacks on financial entities this year.

What happened with MIP Holdings?

MIP Holdings paid a ransom in June 2026, but the group later targeted the company’s clients with their own demands.