Coral targeted by Direwolf ransomware group in alleged data breach

• Ransomware group: Direwolf
• Country: United Kingdom
• Sector: Retail & E-Commerce
• Announcement date: November 13, 2025

The threat actor known as Direwolf has published a leak announcement claiming to have compromised data belonging to Coral. This development follows a common pattern in modern cyberattacks where threat actors utilize dedicated leak sites to pressure organizations by threatening the public release of sensitive information.

The alleged data breach event

According to the announcement made on the group's leak site on November 13, 2025, the Direwolf group claims to have obtained 160 GB of data allegedly belonging to Coral. The group has outlined a specific timeline for the release of this information. They announced that they would publish sample files and a file list on November 15, 2025. This would be followed by the full release of all documents on November 30, 2025.

Information regarding the Direwolf group remains limited in the public domain, making it difficult to ascertain their full capabilities or specific motivations beyond the claim of the breach. In many such instances, ransomware groups employ a tactic known as double extortion. In this scenario, attackers do not just encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. If the victim refuses to pay a ransom, the attackers threaten to leak the stolen information on public forums or their own leak sites to cause maximum reputational and legal damage.

Details of the claimed stolen data

The announcement specifies the types of information that the threat actor claims to have exfiltrated from the organization. The data reportedly includes several critical categories of business and technical information:

• Financial data
• Sales data
• Billing data
• Microsoft SQL Server database files

The inclusion of database files is particularly significant in a cyberattack context. When attackers gain access to database files, they may obtain the structural blueprints of an organization's data management systems, which can be used to facilitate secondary attacks or deeper intrusions into the network architecture.

About Coral

Coral is a well-established betting and gaming company based in the United Kingdom. It provides services in the fields of sports betting, casino games, and various gambling activities.

Impact and organizational implications

The alleged leak indicates that the organization's financial and operational data may be at risk of exposure. The potential disclosure of database files could reveal critical information about the organization's system architecture and facilitate secondary attacks. Furthermore, the publication of customer and sales data may lead to reputational damage and disruption of business operations. Beyond the immediate operational impact, the release of such data could potentially result in legal sanctions for the organization under applicable data protection regulations.

For organizations operating in the retail, e-commerce, and gaming sectors, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically involve implementing strict access controls, ensuring comprehensive encryption for data at rest and in transit, and maintaining rigorous monitoring of network traffic to detect unauthorized exfiltration. Additionally, organizations often focus on regular vulnerability assessments and employee training to mitigate the risk of initial entry by threat actors.

As the timeline set by the Direwolf group approaches, the situation remains centered on the claims made by the attacker. The potential for a large-scale data release necessitates a high level of vigilance regarding data protection compliance and the mitigation of secondary risks arising from the exposure of technical infrastructure details.