Softruck data allegedly leaked by Direwolf ransomware group

• Ransomware group: Direwolf
• Country: Brazil
• Sector: Technology
• Announcement date: October 4, 2026

Direwolf claims to have leaked Softruck data

The threat group known as Direwolf has claimed responsibility for a data breach involving Softruck, a technology company based in Brazil. According to an announcement made on the group's leak site on October 4, 2026, the group alleges they have successfully exfiltrated a significant amount of sensitive information belonging to the organization.

The group claims to have obtained approximately 30 GB of data allegedly belonging to Softruck. The announcement suggests that sensitive information from the company's fleet and device management platform has been compromised. The group has listed the data on their leak platform, marking this as a data leak event rather than a direct ransom negotiation announcement at this stage.

Alleged data contents and affected information

The data allegedly stolen by the Direwolf group is extensive and covers multiple categories of sensitive information. Based on the group's claims, the breach involves a wide range of data types that could impact both the company and its users. The information reportedly includes various forms of personally identifiable information (PII), business documentation, and technical credentials.

The specific types of data allegedly included in the leak are:

• User PII (names, emails, phones, DOB, CPF numbers)
• Financial records
• GPS location data
• Password data
• Business documents

In addition to the items listed above, the group claims the stolen data includes addresses, both encrypted and plaintext passwords, integration credentials, GPS trajectory data, invoices, and various other documents.

About Softruck

Softruck is a Brazilian technology company specializing in vehicle tracking systems, fleet management, and telematics solutions. The company develops software and hardware-based tracking technologies for the logistics and security sectors.

Impact and security implications

The exposure of this data carries significant risks for the affected parties. This breach may increase the risk of identity theft and fraud for Softruck users. The exposure of financial and location data could create secondary attack vectors for the affected individuals. Furthermore, the company may face legal consequences under Brazil's LGPD due to data protection obligations.

While public information about the Direwolf group is limited, such data exposure could damage the company's commercial reputation and weaken its supply chain security. In the context of modern cyber threats, ransomware groups often utilize "double extortion" tactics. In these scenarios, attackers do not just encrypt a company's systems to disrupt operations; they also steal sensitive data and threaten to leak it on public platforms to pressure the victim into paying a ransom. This tactic is particularly effective against companies in the technology and logistics sectors, where data integrity and client trust are paramount.

For organizations operating in the technology and telematics sectors, maintaining robust security postures is essential to mitigate such risks. Common defensive steps for organizations include implementing multi-factor authentication (MFA) to protect user accounts, ensuring all passwords are encrypted, and maintaining strict access controls for sensitive platforms like fleet and device management systems. Additionally, regular monitoring of network traffic and data exfiltration patterns can help detect unauthorized movements of large datasets. Protecting the supply chain is also critical, as a breach in a service provider can have cascading effects on all their clients and partners.