The IT Nerd

The Gentlemen ransomware gang has claimed an attack on MoneyGram, one of the world’s largest payment networks, and is threatening to release the stolen data. MoneyGram serves 60 million active customers across more than 200 countries. 

Rebecca Moody, Head of Data Research at Comparitech: 

“The Gentlemen has become one of the most prolific ransomware groups of recent years and isn’t known for fabricating its claims. MoneyGram needs to issue a statement as soon as possible to either reassure its customers that a breach hasn’t occurred or warn them of any potential unauthorized access to its systems.

Financial organizations are a key target for ransomware groups because of the highly sensitive data they deal with. The Gentlemen has claimed 46 attacks on such entities so far this year. 

Also of note is its attack on a South African tech company, MIP Holdings. This took place in June 2026, with MIP paying The Gentlemen a ransom to delete the stolen data. However, The Gentlemen has now started targeting MIP’s clients and is issuing them with their own ransom demand. This serves as a key reminder that paying a ransomware group to delete data doesn’t guarantee any data will be deleted. In MoneyGram’s case, regardless of whether or not negotiations are successful, individual customers could be contacted by the group. Therefore, MoneyGram’s customers and employees should be on high alert for any potential phishing messages and unauthorized account activity.”

Brian Higgins, Security Specialist at Comparitech:

“It’s very early in the incident response timeline but that’s no reason for anyone who may be affected should this attack prove genuine not to be extra vigilant whilst more details become available. It’s not MoneyGram’s first rodeo so there’s a good chance they will be able to offer decent information and advice as things progress, so it would be a good idea to monitor their comms output. Unfortunately these days more and more people are aware of the personal mitigations they should be considering; changing passwords, monitoring accounts, ignoring and reporting unsolicited contact and checking they have two-factor authentication applied wherever possible etc, but given the volume and diversity of the potentially vulnerable client base on this occasion it’s worth checking in with family, friends and others in your community to make sure they are doing the same. Nobody wants to be worried about their personal financial info being compromised going into Thanksgiving and Christmas so it can only help to look after each other where you can.”

Comparitech in August published a study of The Gentleman ransomware, which can be read here: https://www.comparitech.com/news/the-gentlemen-ransomware-stats-on-attacks-ransoms-data-breaches/

Clients of Goldman Sachs’ wealth management division and UK-listed hedge fund Man Group are among the victims (paywall) of a major data breach at Big Four accounting firm EY, according to notifications sent out in recent weeks.

In other words, this is bad.

Commenting on this is Paul Bischoff, Consumer Privacy Advocate at Comparitech: 

“This breach underlines how modern businesses rely on multiple layers of third-party software over which they have minimal oversight. Goldman Sachs didn’t get hacked. A vendor to a vendor to Goldman Sachs got hacked. Goldman Sachs entrusts client data to both of those vendors but has little to no oversight of either’s security. But clients entrusted Goldman Sachs with their data, not the vendors. Businesses are responsible for the security failures of vendors that they entrust with private data.”

Third party hacks are a thing. So if you assume that you’re only secure as the people you work with, you need to audit those people to ensure that you are secure.

According to a new Comparitech study published today, Q3 2026 saw the highest quarterly figures to date with 2,627 ransomware attacks in total – an average of nearly 29 per day. This is a 29 percent increase on Q2 2026 which logged 2,030 attacks in total, and a 61 percent increase on the same period last year (Q3 2025). 

Additional key findings include:

• Of 247 confirmed attacks:
  • 138 were on businesses
  • 53 were on government entities
  • 36 were on healthcare companies
  • 20 were on educational institutions
• Of the 2,380 unconfirmed attacks*:
  • 2,096 were on businesses
  • 71 were on government entities
  • 152 were on healthcare companies
  • 55 were on educational institutions
• Median ransom demand: $150,000 (average: $602,400)
• The most prolific ransomware gangs were Qilin and The Gentlemen

For full details, the research can be read here: https://www.comparitech.com/news/ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-active-gangs/

Rebecca Moody, Head of Data Research at Comparitech, provided the following comment: 

“I’m often asked what I think lies ahead in the ransomware threat landscape, and it’s notoriously difficult to predict. Figures frequently fluctuate and a sector might see a bit of an increase one month, only to see a slight decrease the next month. However, Q3 2026 is different. We’re not seeing slight increases or decreases. We’re seeing significant increases across all key sectors.

Government agencies, healthcare providers, and the education sector all saw huge increases, as did the majority of business sectors. Seeing some of the most significant rises were tech companies (who often deal with multiple companies and are, therefore, a great central target for hackers), finance companies (who may also deal with a number of companies and/or store highly sensitive data), and utility companies (that form an integral part of our critical infrastructure). 

What’s also of note is hackers’ increasing attempts at triple extortion. They’re not only seeking to encrypt systems and steal data, but are also looking to target individuals/individual companies impacted in an attack. A prime example is The Gentlemen’s recent attack on MIP Holdings (a South African tech company). After being targeted by the group in June 2026, MIP paid a ransom to have stolen data deleted. Over the last few weeks, however, The Gentlemen has started adding MIP’s clients to its data leak site in a bid to get a ransom out of them, too. A key reminder that paying a ransom is absolutely no guarantee that your stolen data will be deleted!”

Comparitech researchers have published a new study looking at which countries are seeing the fastest growth in data centers. 

Data centers are, for the first time, being targeted in military conflicts as a means to disrupt daily life and damage economies. A Russian attack recently hit a Datagroup facility in Ukraine. A series of strikes by Iran in March damaged AWS facilities in both Bahrain and the UAE. A month later, an Oracle data centre in Dubai was damaged.

To find out how the data centre landscape was changing – and where these changes were concentrated – Comparitech analysed the concentration of and increases in data center numbers of 143 countries between 2023 and 2026. 

Key findings include: 

• The US saw the biggest increase in data centres (by numbers reported), rising from 5,300 in 2023 to 5,427 in 2026
• The Netherlands has the greatest concentration of data centres by landmass (8.9 per 1,000 km²) and population (16 per 1 million people)
• A quarter of the countries experiencing the highest data centre growth suffer from ‘extremely high’ water stress
• The US has more than 10 times more data centres than any other country
• Three of the top countries for data centre growth have an internet penetration of less than 50% of the population
• Five of the countries experiencing the highest data centre growth have more than doubled their data centre counts in the past three years

Read more here: https://www.comparitech.com/news/which-countries-are-seeing-the-fastest-growth-in-data-centres/

Comparitech researchers today published a study looking at August 2026 ransomware, finding that last month saw a record-breaking high for attacks at 32 attacks per day.

Key findings for August 2026

• 997 attacks in total — 77 confirmed attacks (confirmed by the entity involved)
• Of the 77 confirmed attacks:
  • 49 were on businesses
  • 18 were on government entities
  • 8 were on healthcare companies
  • 2 were on educational institutions
• Of the 920 unconfirmed attacks*:
  • 812 were on businesses
  • 21 were on government entities
  • 61 were on healthcare companies
  • 22 were on educational institutions
• The most prolific ransomware gangs were Qilin (157) and The Gentlemen (107)
• Qilin had the most confirmed attacks (12), followed by The Gentlemen (8)
• The US saw the most attacks (417), followed by Germany and Italy (48 each), the UK (36), and Canada (35)

Commenting on this study is Rebecca Moody, Head of Data Research at Comparitech: 

“Ransomware threats are escalating across most sectors and continue to have a devastating impact on those affected. One of August’s key attacks was on the government of Berlin, Germany. While the state government should be applauded for not meeting Rhysida’s ransom demand ($2.3M), the ransom looks set to be a drop in the ocean when compared to the costs the government is likely to face. Some recent statements suggest the computer rebuild could cost as much as €100 million (USD $116M) and the breach of over 1 million files is rumored to be the biggest state-level data breach in Germany to date.

Data relating to critical infrastructure is also believed to have been included in the Berlin breach. This, and the jump in attacks on utility companies, healthcare providers, manufacturers, and tech and finance companies, highlight how critical infrastructure remains a key target for hackers. By targeting these sectors, hackers are not only causing mass disruption by encrypting systems but they’re also gaining access to highly sensitive data, including personal data and information about critical systems and infrastructure.”

The full research can be read here: https://www.comparitech.com/news/ransomware-roundup-august-2026/

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) yesterday announced an investigation into a “major” cybersecurity incident that the Qilin ransomware group claimed responsibility for. Given that is is Qilin, that’s all that needs to be said really.

Commenting on this is Paul Bischoff, Consumer Privacy Advocate at Comparitech: 

“We recorded a significant uptick in the number of Qilin’s claims last month. Qilin claimed responsibility for the second-most data breaches out of all ransomware gangs in July, second only to the Gentlemen. Many of Qilin’s attack claims have proven credible. Most experts believe Qilin is based in Russia, which raises further questions about national security and what data was exposed.”

If you want to see more details on the Comparitech report that is being referred to, here you go: https://www.comparitech.com/news/ransomware-roundup-july-2026/

UPDATE: The ATF has since confirmed a breach of one standalone, isolated system that was quickly disconnected, and says its enterprise network, eForms system, and core mission functions were not affected. Qilin listed the ATF on its leak site on August 26 but hasn’t posted the screenshots or stolen documents it typically shares as proof, and the DOJ has designated it a “major incident,” which triggers mandatory federal reporting.

Adrian Culley, offensive security engineer at SafeBreach had this to say:

“ATF’s claim that the compromised system “operates separately from the ATF enterprise network” is the detail worth testing rather than accepting at face value. A genuinely standalone system with no route out has no way to hand data to Qilin’s leak site — so either that isolation has a gap nobody has mapped yet, or the segmentation held and what Qilin is holding is thinner than the leak posting implies. Both are worth knowing before this gets filed as contained.

Qilin’s tradecraft favours exploiting internet-facing systems for initial access (T1190) before attempting lateral movement (T1021) toward whatever segment holds value. That a federal law enforcement agency runs a system isolated enough to survive contact with its enterprise network is good practice. Whether that isolation has actually been tested against an actor trying to break out of it is a separate question, and the more important one.

Owning a segmentation boundary and knowing it holds under a live attack path are not the same claim. Before this incident is closed out, I am sure that the ATF’s own investigators will be running the same lateral-movement techniques Qilin favours against that boundary directly, rather than relying on logs that simply show no crossing occurred.

According to new findings, The Gentlemen gang has claimed responsibility for 675 ransomware attacks, with 600 of these occurring in 2026 so far. This makes The Gentlemen the second-most dominant strain after Qilin. 

The study furthermore breaks down The Gentlemen’s RaaS model, its victims by sector and industry, and its most targeted countries. 

Commenting on this study is Rebecca Moody, Head of Data Research at Comparitech: 

“In less than a year, The Gentlemen has become one of the most dominant groups of recent times — both in terms of the high volume of attacks carried out and the widespread disruption caused by its attacks. 

Its success stems from a number of things, including its rapid exploitation of new vulnerabilities, its collaboration with Breach Forums, and its being an attractive prospect for affiliates. The latter is thanks to the high rewards affiliates are offered: 90% of the ransom payouts, compared to 70 to 80% on average. It’s also targeting a plethora of companies across a wide range of countries and sectors. Other prolific gangs, like Qilin, have a far higher concentration of victims within the US. Avoiding the most ‘saturated’ markets and focusing on less-targeted countries has perhaps increased its success rate. 

At the time of writing, The Gentlemen has claimed 57 new victims this month already (not included in our report stats), meaning it’s on target for a third month of 100+ victims.”

You can read the full report here: https://www.comparitech.com/news/the-gentlemen-ransomware-stats-on-attacks-ransoms-data-breaches/

Content Management Systems (CMSs) power millions of websites worldwide, making them one of the most common ways to publish content online. Because many CMS users have limited cybersecurity expertise, the security protections enabled by default can play an important role in reducing risk.

In a study published today, Comparitech researchers took a look at four of the most popular open-source CMSs (WordPress, Drupal, Joomla, and Ghost), to determine which has the strongest out-of-the-box security. The CMS platforms were assessed immediately following installation to determine their secure-by-default posture, with the assessment considering browser security controls, information disclosure, authentication securiy, and API and enumeration exposure. 

Key findings include: 

• WordPress had the weakest out-of-the-box security protections, with a score of 8 out of 100
• Drupal achieved the highest overall score (27.1 out of 100) – note that none of the tested CMSs provided a particularly strong security posture immediately after installation
• Joomla has had the greatest number of disclosed vulnerabilities in the past five years
• Drupal recorded the highest number of high- and critical-severity core vulnerabilities between 2021 and 2025
• WordPress has the largest extension ecosystem, which may increase exposure to security risks associated with third-party plugins

For full details, please see the research here: https://www.comparitech.com/news/which-cms-platforms-provide-the-strongest-out-of-the-box-security/

With ransomware attacks plaguing businesses and individuals around the world, Comparitech have released their Ransomware Roundup for July 2026, finding that last month saw nearly 26 ransomware attacks per day. 

The research looks into attacks by sector, most prolific groups and attacks by country.

Key findings include:

• 799 attacks in total — 51 confirmed attacks (confirmed by the entity involved)
• Of the 51 confirmed attacks:
  • 31 were on businesses
  • 10 were on government entities
  • 3 were on healthcare companies
  • 7 were on educational institutions
• Of the 748 unconfirmed attacks*:
  • 657 were on businesses
  • 24 were on government entities
  • 50 were on healthcare companies
  • 16 were on educational institutions

You can find the full research here: https://www.comparitech.com/news/ransomware-roundup-july-2026/

Commenting on this is Rebecca Moody, Head of Data Research at Comparitech:

“If we needed a reminder of how dominant a threat ransomware attacks remain, July’s figures provide us with just that. Figures reached the third-highest level in the last 17 months and The Gentlemen and Qilin continued to add hundreds of victims to their data-leak sites. We’ve already logged over 100 victims during the first four days of August 2026, too. 

July also saw some of the year’s most significant ransomware attacks. This includes the attack on the Romanian government’s land registry agency, which saw an entire database being wiped, the crippling attacks on AnMed and Fairlife in the US, and the attack on The Craneware Group, which looks set to have resulted in an extensive data breach. 

These attacks highlight how ransomware groups hit organisations in various different ways — taking down key systems, stealing troves of data, and even deleting massive datasets. Never has it been more important for organisations to ensure they’re carrying out regular backups (and backups of their backups!) so they can reset systems and restore data as quickly as possible if the worst does happen.”

I would put aside some time to give this a read as it will help you to structure your defenses.

Comparitech researchers have published an update to their 2023 study on the cost of cybercrime globally. The new study sees a significant increase in the annual estimated monetary impact of cybercrime — now at $1.24 trillion versus 2023’s figure of $714 billion. 

Key findings include: 

• 103.9 million people fall victim to cybercrimes globally each year, or more than 1,577 victims per 100,000 people
• The average victim loss is $9,468 per crime
• Victims lose an estimated $1.24 trillion to cybercrime annually
• The United States showed the biggest estimated losses at 6.7 million victims losing an estimated $138.9 billion

For full details, click here.