The Gentlemen ransomware operation has added Deloitte, KFC and MoneyGram to its leak site, each with a countdown of roughly nine days. None of the three firms has confirmed an incident and no stolen data has been published, so for now these are claims, not confirmed breaches.
What happened
Over four days, three of the best-known brand names in professional services, fast food and payments appeared on the extortion site run by The Gentlemen, a ransomware-as-a-service operation. Ransomware.live, which scrapes leak sites, logged a Deloitte entry on the evening of 9 October 2026. Trackers including RansomLook and Ervik recorded a KFC listing late on 10 October, and a MoneyGram entry followed on 12 October.
According to TechNadu, each listing carries a payment deadline of about nine days. Cybernews reported that MoneyGram was given a little over a week to open negotiations. The posts contain little beyond the brand names: the Deloitte card shows a generic profile and the words “Data info – soon”, while the KFC entry repeats public background on the business.
No file samples, directory listings, screenshots of internal systems or proof of encryption have been released for any of the three. Deloitte, KFC and its parent Yum! Brands, and MoneyGram had not confirmed any incident in any of the reporting we reviewed, and we found no public statement from any of them at the time of writing. Cybernews said it had approached KFC and MoneyGram for comment, and its reports carried no response. Until a company statement or verifiable evidence appears, these remain unverified criminal claims.
One monitoring account tagged the Deloitte post with a UK flag. Ransomware.live records the entry against the US and flags it as a possible duplicate of an earlier entry. Deloitte operates as a network of legally separate member firms, and the listing does not say which firm, client environment or supplier system, if any, is involved.
The technical picture
Sophos tracks the group as GOLD SHERWOOD. Cybernews and others report that it emerged in 2025 from affiliates previously associated with Qilin, and it runs a double extortion model: steal data first, encrypt second, then threaten publication. TechNadu, citing PRODAFT, says the operation claimed around 330 victims in the first half of 2026 alone, and reports that it offers affiliates a 90 per cent share of proceeds.
From earlier investigations summarised by CyPro, the group’s affiliates have typically broken in through vulnerable internet-facing firewalls or stolen VPN credentials, escalated privileges quickly, leaned on legitimate remote administration tools, tried to switch off endpoint detection and tampered with backups before deploying encryption. Some intrusions reached ransomware deployment within a day. None of that has been linked to these three listings. No indicators of compromise tied to Deloitte, KFC or MoneyGram have been published.
Comparitech’s Rebecca Moody told Security Magazine the group “isn’t known for fabricating its claims”, and pointed to a June 2026 case in which South African firm MIP Holdings paid for data deletion, only for the group to go after MIP’s clients afterwards. Leak-site listings can also be exaggerated, recycled from older incidents, or describe a supplier or franchisee under a bigger brand’s name. KFC’s franchise structure makes that last possibility particularly relevant.
Why it matters for UK organisations
All three brands have a significant UK footprint. Deloitte’s UK member firm counts many large companies and public bodies among its clients. KFC trades across the country, largely through franchisees. MoneyGram’s transfer services are used by UK customers and agents. If any of these claims proves well founded, the people most exposed may be clients, partners and customers rather than the named company.
That is the practical issue for UK organisations this week. A big supplier appearing on a leak site raises immediate questions about your own data protection obligations. Where a processor holds your personal data, UK GDPR expects you to assess the risk and, if a reportable breach has occurred, notify the ICO within 72 hours of becoming aware. A screenshot of a leak site is not, on its own, awareness of a breach. But it is a prompt to ask the right questions, quickly, and to record why you decided what you decided.
The same applies when the name on the leak site is your own. These posts are designed to create pressure before any proof exists and to rush the victim into a hasty response.
Expert view
In my experience, the first hours after a leak-site listing go badly when organisations argue about whether the claim is “real” before checking anything. The listing itself is a fact. Whether you were breached is a question for evidence. Those are separate workstreams and they should run in parallel.
When we test organisations, the routes this group’s affiliates favour are the ones we still find most often: edge devices behind on patches, VPN accounts without multi-factor authentication, and backup consoles reachable with the same domain credentials as everything else. If your own name turned up tomorrow, could you quickly prove those doors were shut? Many cannot, because the logs were never kept.
I would also caution against reading too much into the silence from the three companies. Large firms often stay quiet while forensics run, and silence is not an admission, though clients can reasonably expect a clear statement within days. Paying for deletion, as the MIP Holdings case shows, buys no guarantees.
What to do now
- Treat supplier listings as a third-party risk event. If Deloitte, KFC franchise partners or MoneyGram hold your data or have access to your systems, ask your account contact in writing what they know, and log the request and the answer.
- Map your exposure. List what data, credentials, VPN or API access each named supplier holds. Rotate any shared secrets or service accounts as a precaution.
- Rehearse a “you are on a leak site” playbook. Assign owners for verification, legal and ICO assessment, communications and law enforcement contact (the NCSC and Action Fraud). Agree in advance that nobody engages with the criminals without legal and incident response sign-off.
- Verify, don’t react. Check for unusual exfiltration, new admin accounts and remote tool use. Monitor leak sites yourself or through a provider so you are not learning about it from the press.
- Close the usual entry points (Cyber Essentials: secure configuration, security update management, user access control). Patch firewalls and VPN appliances, enforce multi-factor authentication on all remote access, and remove dormant accounts.
- Protect detection and recovery (Cyber Essentials: malware protection). Turn on EDR tamper protection, alert on attempts to disable Defender or load vulnerable drivers, and keep offline or immutable backups with separate credentials.
- Warn customers about follow-on scams. Publicity around a listing can be enough for fraudsters to send convincing phishing. Remind staff and customers how you will, and will not, contact them.
Bottom line
The Gentlemen have named Deloitte, KFC and MoneyGram, but have shown no evidence, and none of the firms has confirmed an incident. UK organisations should not assume a breach, nor should they ignore the listing. Ask suppliers direct questions, check your own exposure, and make sure your playbook for appearing on a leak site is ready before you need it.
Sources
- Cybernews: Hackers threaten to expose KFC data, as breach allegations circulate
- Cybernews: MoneyGram under threat as hackers claim data breach
- Security Magazine: Did MoneyGram get hacked? Ransomware gang claims it did
- TechNadu: The Gentleman hacking group claims MoneyGram, Deloitte and KFC data breaches
- PlayCISO: Deloitte named on The Gentlemen ransomware leak site
- CyPro: KFC ransomware claim by The Gentlemen unverified
- Ransomware.live: Victim entry, Deloitte (The Gentlemen)
