The stolen data includes copies of government-issued IDs and transaction information for at least some customers, MoneyGram says of last month's cyberattack.
Last month's cyberattack on wire transfer service MoneyGram involved hackers stealing sensitive customer data, including Social Security numbers and bank account numbers.
On Monday, the Texas-based company posted a data breach notice with details on the scale of the cyberattack, which forced MoneyGram to take its website and app offline for several days.
In bad news for users, hackers stole personal information for certain consumers between Sept. 20-22, including names, phone numbers, email and mailing addresses, along with dates of birth.
A more limited number of users also had their Social Security numbers, copies of their government-issued IDs, bank account details, and transaction data, such as the date and money amount, stolen as well. In some cases, criminal investigation information aimed at certain customers was also looted.
The scale of the breach suggests the hackers accessed a server that held customer information. That said, MoneyGram noted: "The types of impacted information varied by affected individual."
It's unclear how many users had their data stolen. For now, MoneyGram says its investigation is ongoing. But the company has boasted of serving over 150 million users, including through its app and 430,000+ locations.
The stolen information could be used for identity theft and other scams. As a result, MoneyGram is urging its users to be on guard against fraud and to monitor their credit reports. "In addition, we have arranged to offer affected US consumers identity protection and credit monitoring services for two years at no cost to you," the breach notice says.
We don't know how the hackers infiltrated MoneyGram, but the company says it's working with leading cybersecurity experts, along with law enforcement, in responding to the cyberattack.