Ransomware Gang The Gentlemen Claims Attack on MoneyGram

Ransomware gang claims MoneyGram breach

The Gentlemen ransomware gang has claimed an attack on MoneyGram, one of the world's largest payment networks, and is threatening to release the stolen data. The notice of the alleged breach appeared on October 12th on the gang's leak site on the dark net. The attackers have not released any data samples to support their claims and have given the company a little over a week to start negotiating.

MoneyGram, headquartered in Dallas, Texas, has not confirmed whether a cyber incident took place or what data may be involved. The company's operations span over 200 countries and serve around 60 million active customers. The scope of the alleged breach is currently unknown, but such a large customer base may pose major risks.

"Since MoneyGram is a company that handles money transfers, the data that the gang allegedly obtained could contain sensitive personal or financial user information," said Cybernews researchers. "This kind of info is really monetizable on the dark web, also there could be risks of financial fraud and social engineering campaigns targeting the users," they added.

What we know about The Gentlemen

Researchers at ASEC, the threat intelligence and research division of South Korean cybersecurity firm AhnLab, believe the gang's technical sophistication points to a coordinated team with extensive experience in enterprise-focused attacks. The Gentlemen relies on ransomware-as-a-service to profit and employs a double-extortion model, splitting revenue with affiliates who use its illicit infrastructure.

The gang originated as ArmCorp, a prolific affiliate cluster of the Qilin ransomware program comprising approximately 20 members. According to security firm Halcyon, the split was triggered by a payment dispute on July 2nd, 2025, when the threat actor known as "hastalamuerte" filed a public arbitration complaint on the RAMP underground forum, alleging that Qilin owed roughly $48,000 in unpaid commission. The first Gentlemen ransomware sample appeared on VirusTotal on July 17th, 2025, five days before the public dispute, with the leak site URL already hardcoded into the binary, indicating the separation was premeditated.

Fintech platforms remain prime targets

The Gentlemen has listed a number of recent victims, including NATO contractor Indra, European data exchange platform FTAPI, Dutch ice arena Thialf, LA Metro, and Glassdoor. Fintech platforms are especially attractive to cybercriminals because they handle money and hold large amounts of personal data.

MoneyGram suffered a cyberattack in 2024, reportedly via social engineering targeting its IT help desk. The attack knocked out its systems for 5 days and resulted in the theft of customer personal data, including names, Social Security numbers, government IDs, and transaction records. Earlier this year, UK-based fintech giant Revolut suffered a data breach after fraudsters impersonated an Italian government agency to extract customer data. At the beginning of the year, PayPal notified customers that an attacker had lurked inside its systems for roughly 6 months, an incident tied to its Working Capital app that exposed Social Security numbers and other sensitive data. In August, hackers claimed Stripe as a victim, with customer information surfacing on a cybercrime forum. Last year, the Everest ransomware group claimed an attack on the Money Mart check-cashing and short-term loan chain.

Sources: Cybernews