Cyberattack halts MoneyGram transfers; customer data stolen

Analyst assessment

MoneyGram’s money-transfer services became unavailable Sept. 20, 2024. The Dallas-based company initially described a network outage, then acknowledged a cybersecurity issue Sept. 23 and said it had isolated systems. The Register’s contemporary report links that acknowledgment to the disruption. The incident is confirmed with high confidence.

MoneyGram later confirmed that an unauthorized party accessed and acquired some consumers’ information Sept. 20–22. Its Oct. 7 notice, preserved by the Montana Department of Justice, says the company determined this Sept. 27. Affected information varied by person and included identity and contact details, identification documents, bank-account and transaction information, and limited Social Security numbers. The acquisition finding is separate from the earlier public outage and cyber acknowledgment.

Operational significance

Customers could not send or receive transfers through affected online and in-person channels, and the website was unavailable. BleepingComputer’s Sept. 24 report documents those access problems. The disruption affected access to remittances and payments; MoneyGram’s global customer count does not establish how many people lost access or that every agent’s own systems were compromised.

Recovery occurred in stages. The Record’s Sept. 26 report quotes MoneyGram saying several partners could send and receive funds Sept. 25. Its next statement said the website and app were available and customers could use digital platforms and agents, while pending transactions were still being fulfilled. Reopening the channels therefore did not establish that the transaction backlog had cleared.

Confidence and uncertainty

The company’s Oct. 7 release confirms normal business operations had resumed. This supports resolved operational status. Sept. 26 is the latest reviewed dated statement of continuing transaction fulfillment; the exact end of material disruption is not established. The later data notice is not evidence that the outage continued into October.

Ransomware involvement remains unresolved. In an Oct. 5 report, BleepingComputer quotes a Sept. 25 company email saying investigators had found no evidence of ransomware or reason to believe agents’ systems were affected. The report’s anonymous-source account of help-desk social engineering and comparison with Scattered Spider techniques do not establish an attacker, encryption, a ransom demand or payment.

MoneyGram’s 2025 financial statements reported that consolidated U.S. data-breach litigation ended June 27, 2025, after the plaintiffs voluntarily dismissed their case. In their account of developments through early 2026, the statements also reported dismissal of a separate California action Feb. 9, 2026, and described continuing litigation in British Columbia.

Analytic gaps

The exact initial access method, attacker, number of affected consumers and date that pending transfers were fully processed remain unverified. Later litigation allegations about credential resets and restoration require reconciliation with the contemporary recovery statements. Financial or legal consequences continuing after restoration do not by themselves establish an ongoing service outage.

The company documented disruption and publicly connected it to cybersecurity by Sept. 23. An earlier outside social-media lead could not be recovered, so the sequence between the first institutional and external cyber characterizations remains unresolved. Sept. 27 is the data-acquisition determination date, rather than the incident’s start. The reviewed evidence supports a Sept. 20 start but does not establish the exact date that material impact ended.