Pergamon Status Diş Ticaret A Ş targeted by Direwolf ransomware group

• Ransomware group: Direwolf
• Country: Türkiye
• Sector: Professional Services
• Announcement date: July 20, 2025

Direwolf claims data breach at Pergamon Status Diş Ticaret A Ş

The threat actor known as Direwolf has published an announcement on a leak site claiming to have obtained a significant amount of data belonging to Pergamon Status Diş Ticaret A Ş. According to the claims made by the group, the breach involves approximately 50 GB of information stolen from the organization's systems.

The incident was announced on July 20, 2025. The threat actor alleges that the attack took place on the same day the announcement was posted. While information regarding the specific identity and background of the Direwolf group remains limited, the group has outlined a specific timeline for the release of the allegedly stolen information. They stated that they would publish sample files and a comprehensive file list on July 20, 2025, with the intention of releasing all documents in their entirety on July 30, 2025.

Details of the allegedly stolen data

The content of the alleged leak is substantial, covering various aspects of the company's internal operations and financial standing. According to the information shared in the announcement, the data claimed to be leaked includes a variety of sensitive business records. The specific types of data identified in the claim include:

• Oracle data
• Financial data
• Import and export data
• Tax data
• Audit data

The disclosure of such diverse datasets suggests a broad access to the company's core administrative and operational databases.

About Pergamon Status Diş Ticaret A Ş

Pergamon Status Diş Ticaret A Ş is a Turkish company that operates within the international trade and logistics sector. The organization provides a range of services, including foreign trade operations and supply chain management, serving various industries through its logistics and trade expertise.

Risk assessment and implications of the breach

This alleged data breach may pose significant risks to the company's commercial operations and its financial records. Given the specific nature of the data claimed to be stolen, secondary risks may emerge, such as targeted phishing attacks or identity theft aimed at the company's customers and business partners. Furthermore, because the company operates in Turkey, the incident may lead to legal consequences regarding data protection obligations under the Law on the Protection of Personal Data (KVKK).

Beyond the immediate operational continuity, the disclosure of trade secrets could potentially harm the company's competitive advantage in the international trade market. The method employed by the threat actor—releasing data in stages—may indicate a double-extortion strategy. Double extortion is a common ransomware tactic where attackers not only encrypt a victim's data but also steal it, threatening to leak it publicly to exert maximum pressure on the organization to pay the ransom.

In such scenarios, organizations typically face immense pressure to manage both the technical recovery from an intrusion and the reputational management resulting from data exposure. For companies in the logistics and international trade sectors, maintaining the integrity of supply chain data is vital for trust between global partners. Defensive measures for organizations facing such threats often include robust encryption for data at rest and in transit, strict access controls to sensitive databases like Oracle, and comprehensive monitoring to detect unauthorized data exfiltration before large volumes of data can be moved.