Ransomware Gang Claims MoneyGram Data Theft

TL;DR

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

A ransomware gang claimed on Oct. 12 that it stole data from MoneyGram and threatened to publish it unless the company negotiates, according to Cybernews. MoneyGram had not confirmed an incident, and the group had not provided data samples in the reporting available.

A ransomware gang claimed Monday, Oct. 12, that it stole data from payment company MoneyGram and would publish the material unless the company began negotiations, Cybernews reported. MoneyGram had not confirmed a cybersecurity incident, and the attackers had not shared data samples, leaving the claim unverified.

Cybernews said the threat appeared in a post on the dark web, where the group set out its demand for negotiations. The report did not identify the alleged information, say when it may have been taken, or establish how much data was involved. Without samples or confirmation from MoneyGram, the public information does not establish that the gang accessed or removed company data.

MoneyGram did not immediately respond to PYMNTS’ request for comment, according to the outlet’s Oct. 12 report. That lack of an immediate response is not confirmation of a breach. No public statement from the company confirming the gang’s allegation was included in the source report.

The reported threat is a claim by an alleged attacker, rather than an independently verified account of a breach. The group’s stated intention to publish data if negotiations do not begin also does not establish that it possesses the information it says it stole. The source material provides no details about affected customers, employees, systems, or whether any personal or financial information may be involved.

Potential Risks for MoneyGram Customers

If the allegation is substantiated, a data theft could create risks for people whose information was exposed, including potential misuse of personal details. But the source reporting does not establish that customer records were accessed, or even that the gang has MoneyGram data. Readers should distinguish the potential consequences of a breach from facts confirmed so far.

The claim also matters because MoneyGram operates in payments, where a verified security incident could draw attention to the protection of sensitive information and the reliability of services. At this stage, however, there is no confirmed disruption or customer impact described in the report. The key developments to watch are whether MoneyGram acknowledges an incident, whether the attackers publish verifiable material, and whether any authorities or affected individuals receive confirmed information.

MoneyGram’s Earlier Security Incident

MoneyGram reported a separate incident in September 2024, when it said it experienced a network outage and found a “cybersecurity issue.” The 2024 event is distinct from the current gang’s allegation; the source material does not connect the two incidents or establish that they share a cause.

The broader scale of cybercrime provides context, but does not verify this particular claim. The FBI’s Internet Crime Complaint Center said its 2025 Internet Crime Report recorded 3,611 ransomware complaints and $32.32 million in reported losses. The report also described ransomware as a significant threat to critical infrastructure organizations. Those figures cover reports received by IC3 and should not be read as evidence about MoneyGram’s situation.

“It would publish the data if MoneyGram did not start negotiating.”

— The ransomware group, as reported by Cybernews

Breach Evidence Has Not Emerged

Several central details remain unknown: whether MoneyGram systems were accessed, whether data was taken, what type of information may be involved, and whether the group’s threat is credible. Cybernews reported that the attackers had not shared data samples; the source material also contains no forensic findings or confirmation from the company.

It is also unclear whether the incident, if one occurred, affected customers, staff, vendors, or MoneyGram operations. The reporting does not state whether the company contacted law enforcement or regulators, or whether negotiations have begun. Those points should not be inferred from the gang’s post or the company’s lack of an immediate reply.

Watch for Company Confirmation

The next meaningful update would be a statement from MoneyGram confirming or disputing the allegation, or providing information about any investigation and possible impact. The source report does not give a timeline for such a response. Verification could also come from independently reviewed samples or other evidence, but none was described as available at the time of reporting.

Until further information is released, the claim should be treated as unverified. Customers who want guidance should rely on official MoneyGram communications rather than the attackers’ assertions; the available reporting does not identify a confirmed incident-specific action for customers to take.

Key Questions

Has MoneyGram confirmed a data breach?

No. The Oct. 12 report said MoneyGram had not confirmed an incident. The company did not immediately respond to PYMNTS’ request for comment.

What did the ransomware gang claim?

The gang reportedly claimed it stole MoneyGram data and threatened to publish it unless the company began negotiating. This is an allegation, not a verified account.

Has the group shown proof that it has the data?

Cybernews reported that the attackers had not shared data samples. The source material does not describe other independent evidence of theft.

Are MoneyGram customers known to be affected?

No customer impact has been confirmed in the reporting. It remains unknown whether any customer, employee, or other data was accessed.

Source: rss