The Gentlemen list KFC, MoneyGram, Deloitte and Confluent

The Gentlemen ransomware operation listed seven high-profile organisations on its leak site between 9 and 11 October 2026: Deloitte, the Royal Thai Air Force, KFC, Placer.ai, MoneyGram, Confluent and BigID. Each entry carries a countdown to publication. None of the seven has confirmed an intrusion, the group had published no samples for the largest names as of the first reports on 12 October, and the listings arrived during the operator’s busiest year on record, with 944 listings recorded on the Ransomtracker so far in 2026.

Who are The Gentlemen?

The Gentlemen is a ransomware-as-a-service operation that surfaced in mid-2025 and has become the second most active leak-site poster of 2026. The operator profile on the Ransomtracker shows 944 listings this year against 78 in all of 2025, behind only Qilin’s 1,071. August was its busiest month with 163 listings, September added 106, and the first half of October brought 50 more. Sophos tracks the operation as GOLD SHERWOOD and describes affiliates who escalate privileges quickly, lean on legitimate remote-access tools, attempt to disable security controls, and in some cases deploy the encryptor within 24 hours of the first observed activity. We profiled the group’s leaked internal playbook and its victim pattern earlier this year in The Gentlemen: 483 victims and a leaked playbook; the count has nearly doubled since.

What was listed, and when?

The live leak-site index recorded the seven entries in this order: Deloitte on 9 October at 16:37 UTC, the Royal Thai Air Force on 10 October at 20:12, KFC at 23:36, Placer.ai at 23:49, then MoneyGram, Confluent and BigID between 00:02 and 00:25 on 11 October. Seven brand-name listings in 32 hours is unusual even for an operator posting three listings a day. The KFC entry, as captured by Cyber Security News, shows the company’s branding, domain and a business description, with no visible stolen files, no stated data volume and no ransom figure. Security Magazine reported on 12 October that no samples had been published for MoneyGram either, and that the company had not confirmed an incident.

Deloitte’s listing has drawn attention because of its history. In December 2024 the Brain Cipher group claimed to have stolen Deloitte data, and Deloitte said that claim concerned a single client’s system outside the Deloitte network. The firm was also central to the RIBridges breach in Rhode Island, where it operated the state benefits platform that was compromised in late 2024 and later reached a settlement with the state. None of that history verifies the October 2026 claim, and Deloitte had not commented on it at the time of writing.

Why the scope of each claim matters

A leak-site entry names a brand, not a network. KFC is a franchise system with thousands of independently operated restaurants and a parent, Yum! Brands, which disclosed a genuine ransomware incident in January 2023 that closed fewer than 300 restaurants in one market for a day. A listing that says “KFC” could refer to the corporate network, a franchisee, a regional master franchise or a supplier holding KFC data, and the entry gives no way to tell. The same applies to Deloitte, whose member firms are legally separate, and to MoneyGram, which suffered a confirmed, non-ransomware intrusion in September 2024 that began with social engineering of its IT help desk, forced a five-day outage and exposed customer identity documents, bank account numbers and transaction records. A new claim against a company with that recent history deserves a direct answer, and MoneyGram has not yet given one.

What does the stealer-log exposure show?

Infostealer logs are the most common source of the credentials that ransomware affiliates buy, and the exposure around these seven domains is large. Stealercheck, which queries the Alerts.bar index that Ransomnews licenses, shows 6,661 staff-account credentials and 131,681 session cookies associated with deloitte.com, 878 staff credentials for rtaf.mi.th, 51 staff credentials and 39,624 cookies for moneygram.com, and 28 staff credentials with 27,982 cookies for confluent.io. These are cumulative counts from logs collected over time, and they say nothing about how, or whether, The Gentlemen got in. They do show that for organisations of this size, a valid employee session is rarely hard to buy, which is why we keep pointing readers back to the initial-access market rather than to exotic exploits.

What should the named companies and their customers do?

The named companies should say what they know, quickly, because silence while a countdown runs is read as confirmation. For customers and employees the practical advice is the same whether the claim is true or not: expect phishing that references the breach, treat unexpected password-reset and verification messages with suspicion, and for MoneyGram customers in particular, watch transaction history, since the 2024 incident already put identity documents in criminal hands. Defenders at the listed organisations should review remote-access logs for the first week of October, because the group’s affiliates move from access to encryption in hours rather than weeks.

What this means for the ransomware market

Big names on a leak site are a pressure tactic as much as a disclosure, and The Gentlemen have the volume to spend reputation on a bluff. A run of unverified brand-name claims costs the operator little if even one victim pays. The test is what the countdowns produce. If data appears, the listings will move from claim to confirmed on the daily digest and in the 2026 year archive. If they expire quietly, the episode will say more about the group’s marketing than about any of the seven companies’ security.

Frequently asked questions

Sources and further reading

• Security Magazine, Did MoneyGram get hacked? Ransomware gang claims it did (12 October 2026)
• Cyber Security News, KFC named in Gentlemen ransomware group’s latest breach claim (12 October 2026)
• heise online, Cybercriminals claim data leak at Confluent, Deloitte, KFC and MoneyGram
• BleepingComputer, MoneyGram confirms hackers stole customer data in cyberattack (2024)
• Ransomnews Ransomtracker, The Gentlemen operator profile, listings recorded 9 to 11 October 2026
• Related: what ransomware-as-a-service actually is, and the threat-group catalogue

Reporting by the Ransomnews Research Team. Exposure figures are aggregate counts from the Alerts.bar index, an independent provider whose data Ransomnews licenses; no credentials are reproduced and no leak-site content is linked.