Lifesum data allegedly leaked by Direwolf ransomware group

• Ransomware group: Direwolf
• Country: Sweden
• Sector: Healthcare
• Announcement date: August 19, 2026

Direwolf claims to have stolen Lifesum data

The ransomware group known as Direwolf has published a leak announcement claiming responsibility for a data breach involving the Swedish digital health company Lifesum. According to the announcement made on a leak site on August 19, 2026, the group claims to have obtained a significant dataset belonging to the organization. While the group has released a leak announcement, the specific details regarding the attack itself remain limited, as public information concerning the Direwolf group is currently restricted.

The group claims to have successfully exfiltrated a dataset totaling 2.15 GB in size. This alleged breach involves a substantial amount of information, with the group claiming the dataset contains 4.37 million rows of data. The timeframe for the information contained within this alleged leak is stated to span from 2008 to 2026, suggesting a long-term accumulation of data within the compromised files.

Details of the alleged data leak

The content of the leaked data, as claimed by the Direwolf group, is extensive and covers various aspects of user interaction with the service. The group alleges that the stolen information includes sensitive personal and financial details that could pose significant risks to the affected individuals. The data reportedly includes the following items:

• User food diaries
• Payment information
• Subscription details
• Health profiles
• Exercise records
• API tokens
• Gift card details

In addition to the items listed above, the group claims that the dataset contains user preferences and transaction metadata. The inclusion of API tokens is particularly noteworthy, as these are often used to facilitate communication between different software components, and their exposure can lead to further security complications.

About Lifesum

Lifesum is a digital health and lifestyle application designed to assist users in tracking their nutrition, diet, and exercise habits. The company focuses on providing personalized nutrition plans and health data analysis to its user base. Based in Sweden, the organization operates within the healthcare sector, managing sensitive information related to the physical well-being and lifestyle choices of its users.

Potential risks and security implications

If the data released by the Direwolf group is accurate, the exposure of such a wide range of health and financial information presents serious risks to the individuals involved. The combination of health profiles, exercise records, and food diaries alongside payment details creates a high potential for identity theft or highly targeted phishing attacks. Furthermore, the presence of leaked API tokens introduces a secondary risk, as unauthorized actors may attempt to gain access to systems through these credentials.

Given that Lifesum is based in Sweden, this incident may lead to legal consequences under the General Data Protection Regulation (GDPR), which governs the handling of personal data within the European Union. For organizations operating in the healthcare and digital health sectors, such incidents highlight the critical importance of robust data security processes. Defensive measures typically involve regular security audits, the implementation of strong encryption for data at rest and in transit, and the strict management of API credentials to prevent unauthorized access.

In the event of such a breach, organizations are generally expected to review their data security protocols and inform the affected users to mitigate further harm. The complexity of modern digital health platforms means that protecting diverse data types—from simple user preferences to sensitive medical-related lifestyle data—is a continuous challenge for the industry.