TrainMe data allegedly leaked by Direwolf ransomware group

• Ransomware group: Direwolf
• Country: Colombia
• Sector: Education
• Announcement date: September 7, 2026

Direwolf claims to have leaked TrainMe data

The threat actor group known as Direwolf has claimed responsibility for a data breach involving TrainMe, a corporate wellness platform based in Colombia. According to an announcement posted on the group's leak site on September 7, 2026, the attackers claim to have obtained a significant volume of sensitive information belonging to the organization.

The group alleges that the data was compromised on September 7, 2026. The announcement includes a massive amount of information, reportedly consisting of 78,000 files and totaling approximately 2.8 GB in size. While the group has published this information on their platform, public information regarding the specific methods or identity of the Direwolf group remains limited.

Details of the allegedly stolen information

The content of the leaked data, as claimed by the threat actors, covers a wide range of sensitive categories. The information allegedly includes various types of personal and corporate data that could be used for malicious purposes. The specific items listed in the announcement include:

• Customer PII
• Employee data
• Email addresses
• Phone numbers
• Physical addresses
• Payment records
• OAuth tokens
• Encrypted passwords
• Corporate communications

The presence of such diverse data types suggests a deep level of access to the organization's internal systems and databases. The inclusion of technical configuration files and OAuth tokens is particularly significant for understanding the potential impact on the organization's digital infrastructure.

About TrainMe

TrainMe is a Colombia-based corporate wellness and employee well-being services platform. The company develops programs aimed at improving the physical and mental health of employees.

Potential risks and security implications

The nature of the allegedly leaked data may pose significant secondary risks to both the organization and the individuals involved. The exposure of customer PII, email addresses, phone numbers, and physical addresses can facilitate identity theft and targeted phishing attacks against the organization's customers and employees. Such attacks often leverage the stolen information to gain further trust from the victims.

Furthermore, the exposure of operational data and technical keys, such as OAuth tokens and technical configuration files, may lead to long-term security risks for the organization's infrastructure. The presence of payment details and OAuth tokens may also facilitate supply chain attacks, where attackers use the compromised credentials to move laterally or access other connected services.

The group's method of publishing this data on a leak site may be seen as an indication that they might be pursuing a double-extortion strategy. In such scenarios, threat actors not only encrypt an organization's systems but also steal sensitive data to use as leverage during ransom negotiations, threatening to release it publicly if the demands are not met.

From a regulatory perspective, the exposure of personal data may result in legal sanctions for the organization under relevant frameworks, such as the GDPR. Organizations in the wellness and health-related sectors must prioritize the protection of sensitive employee and customer data to mitigate these risks. Common defensive steps for organizations include implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication to protect against token theft, and maintaining rigorous monitoring of technical configuration files and access logs to detect unauthorized changes or access.