The Gentlemen, a ransomware group, has claimed data breaches at MoneyGram, Deloitte and KFC, according to TechNadu.
The group has not published any stolen files from the three companies, leaving the claims unverified.
The Gentlemen emerged as a ransomware-as-a-service operation around July to August 2025, running a double-extortion model in which affiliates steal and often encrypt victim data before threatening to publish it unless a ransom is paid.
Its growth has been fast: KPMG had tracked more than 30 claimed attacks across 17 countries by November 2025, concentrated in manufacturing, healthcare, insurance, aviation and consumer services.
The pace accelerated through 2026, with Check Point counting over 320 claimed victims by April, 240 of them in just the first months of the year.
ReliaQuest recorded 300 victims in the second quarter alone, 101 in April, 77 in May and 122 in June, making The Gentlemen the most active ransomware group of that quarter.
But leak-site listings are claims rather than proof of compromise; one tracker counted 580 alleged victims across 77 countries by 7 July, yet could independently verify only 92 through breach notices, regulatory filings or credible reporting.
The group's own infrastructure was reportedly compromised in May 2026, exposing 3,366 internal chat messages and details on more than 1,570 potential targets, a sign of the operation's scale rather than confirmation of any specific victim.
MoneyGram, Deloitte and KFC have not confirmed any breach.
