The Gentlemen ransomware gang has listed KFC, Deloitte, Confluent and MoneyGram as alleged victims on its darknet leak site, with the claims published by 10 October raising concerns about potential data theft but remaining unverified by the companies.
Cybernews reported that the group listed KFC on 10 October, threatening to publish allegedly stolen information unless the fast-food business entered negotiations. The gang has not provided samples of the purportedly stolen files, and KFC has not confirmed a breach.
German technology publication Heise reported that the listings for all four organisations appeared on The Gentlemen’s leak site without details of the type or volume of data allegedly obtained. The companies had not publicly responded to the claims at the time of publication.
The scope of any potential compromise remains unclear. The available information does not establish which systems were affected, how attackers might have gained access or whether sensitive customer or financial information was taken.
KFC’s global scale could make a confirmed incident significant. The brand operates nearly 32,000 restaurants across more than 150 countries and territories, according to Cybernews, although the current allegations do not establish that its restaurant network or customer systems have been compromised.
Heise’s reporting on the gang’s other alleged victims highlighted an earlier incident involving software provider FTAPI, whose stolen data was subsequently published on the darknet. An initial examination suggested the files included marketing material and a customer list, while FTAPI had previously said the breach was confined to a single local server and that its platform and customer systems were unaffected.
The Gentlemen operates a ransomware-as-a-service model, enabling affiliates to use its infrastructure to conduct attacks. Cybernews reported that the operation employs double extortion, in which attackers steal data and threaten to publish it to pressure victims into paying a ransom.
Cybersecurity researchers have linked the group’s origins to Qilin ransomware affiliates following a reported dispute over unpaid commissions in 2025. However, the background of the operation does not establish that any particular organisation named on its leak site has suffered a confirmed intrusion.
KFC’s parent company, Yum! Brands, previously confirmed a separate cyberattack in 2023 that exposed sensitive employee information, according to Cybernews. That incident provides historical context but is not evidence that the latest allegation is legitimate.
For the four organisations named in the latest claims, confirmation of any breach, the nature of the data involved and the extent of any potential exposure remain outstanding. KFC, Deloitte, Confluent and MoneyGram did not respond to request for comment from National Technology News.
