RelyComply AML Platform listed on direwolf leak site

• Ransomware group: direwolf
• Country: United Kingdom
• Sector: Financial Services
• Announcement date: September 9, 2026

The RelyComply AML Platform has been listed on the leak site of the threat actor known as direwolf. According to the claims made by the group, the institution's production databases and identity verification systems have been compromised.

Details of the alleged attack

The direwolf group has published 200 GB of data that they claim belongs to the RelyComply AML Platform on their leak site. The threat actor alleges that they have successfully gained access to the institution's production databases, S3 storage buckets, and identity verification processes. This alleged breach was reported to have been published on September 9, 2026.

In modern cyberattack scenarios, ransomware groups often employ a tactic known as double extortion. In this method, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak stolen data on public or private leak sites, the threat actors attempt to pressure the victim into paying a ransom to prevent the exposure of confidential information. This approach increases the pressure on organizations, as the leak of sensitive data can lead to significant regulatory, legal, and reputational consequences.

Alleged compromised data

The data allegedly stolen by the threat actor is extensive and includes highly sensitive information. The reported data types include:

• Customer personally identifiable information (PII)
• Bank account details (SWIFT/IBAN)
• ID scans
• Passport information
• Transaction monitoring logs
• People graph data
• Regulatory reporting files

Additionally, the group states that system credentials and data linked to S3 objects have been compromised. The breadth of this alleged data exposure suggests a deep penetration into the organization's digital infrastructure.

About RelyComply

RelyComply is a software platform that automates anti-money laundering (AML) and compliance processes for financial institutions. It provides specialized solutions for Know Your Customer (KYC) and transaction monitoring, serving as a critical component in the regulatory framework for financial services.

Risk assessment and implications

This alleged leak may increase the risk of identity theft and financial fraud for the institution's customers. Given the sensitivity of the leaked data, legal processes under UK data protection regulations and GDPR might be triggered. The institution's operation in the financial software sector could pose a risk for supply chain attacks, where a breach in a service provider allows attackers to target the organization's clients.

If these claims are verified, it is possible that affected individuals could be exposed to targeted phishing attacks. Such attacks often use stolen personal details to appear legitimate, making it easier for criminals to deceive victims. Public information regarding the direwolf group remains limited.

For organizations operating in the financial software and compliance sectors, maintaining robust security postures is essential. Common defensive steps include implementing multi-factor authentication (MFA) across all systems, ensuring strict access controls for S3 buckets and databases, and maintaining regular, encrypted backups. Furthermore, organizations often focus on continuous monitoring of their network for unusual activity and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.