InfoFlo CRM listed on direwolf leak site

• Ransomware group: direwolf
• Country: United States
• Sector: Technology
• Announcement date: August 19, 2026

Software provider InfoFlo CRM listed on direwolf leak site

The software provider InfoFlo CRM has been listed on the leak site of the threat group known as direwolf. According to the claims made by the threat actors, a significant amount of data has been compromised during the attack.

Details of the alleged breach

The direwolf group has listed data they claim belongs to InfoFlo CRM on their leak site. The threat actors allege that a dataset totaling 71 GB, consisting of 56,164 files, has been compromised. Information about this group is limited in the public domain, making it difficult to ascertain their specific tactics, techniques, or procedures through public records alone.

The allegedly leaked data includes a wide variety of sensitive information. The specific items claimed to be part of the breach include:

• Backup data
• Voicemails
• Voice recordings
• CDR entries
• Source code
• SAM hashes
• Client keys

About InfoFlo CRM

InfoFlo CRM is a technology company that provides customer relationship management (CRM) software for businesses. The company develops software solutions aimed at optimizing sales and marketing processes.

Analysis and potential impact

These claims may pose risks to the organization's operational continuity and intellectual property rights. The potential exposure of source code and SAM hashes could lead to an increase in secondary attacks against the organization's systems or supply chain risks. As a US-based organization, legal processes may be triggered under data breach notification requirements and state-level privacy laws.

The disclosure of customer data and voice recordings may create risks for individuals, such as identity theft or targeted phishing attacks. The organization may need to conduct a comprehensive forensic investigation to determine the scope of the leaked data.

In the context of modern cyber threats, ransomware groups often employ a double extortion tactic. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also exfiltrate sensitive information to use as leverage. By threatening to publish stolen data on public leak sites, attackers aim to pressure the victim into paying a ransom to prevent the disclosure of proprietary or customer information.

For organizations in the technology and software sector, such incidents highlight the critical importance of protecting intellectual property and maintaining robust security frameworks. Common defensive steps for organizations facing such threats include implementing strict access controls, maintaining offline backups, and conducting regular vulnerability assessments. Furthermore, monitoring for unauthorized data exfiltration and ensuring comprehensive logging can assist in the early detection of such incidents.