Interseguro targeted by Direwolf ransomware group

• Ransomware group: Direwolf
• Country: Peru
• Sector: Financial Services
• Announcement date: October 13, 2026

Direwolf claims data breach at Interseguro

The Direwolf ransomware group has listed a significant amount of data on its leak site, claiming the information belongs to Interseguro, a prominent financial services institution based in Peru. According to the announcement made on October 13, 2026, the threat actor group alleges they successfully breached the organization's systems. The group claims to have exfiltrated approximately 2.5 TB of data during the attack, which they assert took place on October 11, 2026.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms by threatening to release sensitive information to the public. This tactic is frequently associated with double-extortion methods, where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive files to use as leverage during negotiations. While the institution has acknowledged that unauthorized access occurred, they have stated that their operational processes remain unaffected by the incident.

Details of the alleged data theft

The data allegedly stolen by the Direwolf group is highly sensitive, encompassing a wide range of personal and corporate information. The breach, as claimed by the attackers, involves a vast collection of files that could impact various stakeholders of the organization. The specific types of data mentioned in the leak site announcement include:

• Customer identity information (DNI)
• Contact details
• Address data
• Policy details
• Vehicle license plates
• Credit bureau data
• Employee information

The inclusion of such diverse data types—ranging from identity documents to insurance policy details and vehicle information—indicates a broad compromise of the data stored within the organization's environment. Such a large volume of data, totaling 2.5 TB, suggests a significant intrusion into the company's digital infrastructure.

About Interseguro

Interseguro is a leading insurance company based in Peru. The organization provides a variety of financial products and services to both individual and corporate clients. Their service portfolio includes life insurance, pension plans, and various other general insurance products designed to meet the needs of their diverse customer base.

Impact and security implications

This incident may pose significant secondary risks to both the customers and employees of Interseguro. The exposure of identity information, contact details, and credit bureau data can facilitate malicious activities such as identity theft and highly targeted phishing attacks. When attackers possess detailed personal information, they can craft more convincing social engineering campaigns to deceive victims.

Furthermore, the disclosure of financial and personal information carries the potential for substantial reputational damage and a loss of customer trust. Given the sensitivity of the leaked data, the institution may also face legal sanctions under the regulatory frameworks governing data protection in Peru. The intersection of financial services and sensitive personal data makes such breaches particularly high-stakes for the affected organization.

In the wake of such incidents, cybersecurity experts generally recommend that affected organizations take proactive steps to mitigate damage. This includes notifying all parties whose data may have been compromised and conducting a comprehensive review of existing security measures to prevent future unauthorized access. For organizations in the financial sector, maintaining robust data protection protocols and monitoring for signs of identity theft or fraudulent activity is essential to maintaining operational integrity and public confidence.