Wolfram Research allegedly targeted by direwolf ransomware group

• Ransomware group: direwolf
• Country: United States
• Sector: Technology
• Announcement date: September 4, 2026

The threat actor group known as direwolf has listed approximately 2.5 TB of data, which they claim belongs to Wolfram Research, on their dedicated leak site. The announcement, made on September 4, 2026, suggests a significant breach involving a massive volume of information allegedly taken from the technology company's internal systems.

The alleged data breach event

According to the claims made by the direwolf group, the attackers have obtained a comprehensive dataset belonging to Wolfram Research. The group asserts that the files stolen include information from the organization's internal infrastructure, source code, and various databases. This type of activity is characteristic of modern ransomware operations, where threat actors often employ double extortion tactics. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release if a ransom is not paid.

The group has stated that the data in question is approximately 2.5 TB in size. Furthermore, the attackers claim that the stolen information is currently being held in a compressed format. While the specific timing of the initial intrusion was not detailed beyond the announcement date, the scale of the claimed data suggests a significant period of unauthorized access to the target's environment.

Details of the claimed stolen data

The contents of the leak, as described by the direwolf group, involve a wide variety of sensitive technical and corporate information. The announcement claims to include several critical components of the organization's digital assets, such as Wolfram Alpha production databases and the company's proprietary source code. Additionally, the group claims to have accessed SugarCRM customer data, as well as authentication data from Bitwarden and Keycloak.

Beyond user and customer information, the group alleges they have obtained backups of essential development tools, specifically mentioning Jira and TeamCity. The list of compromised items also includes various network and infrastructure configuration files. The specific items claimed to be affected include:

• Source code
• Customer data
• Authentication credentials
• Infrastructure configuration files
• Database backups

About Wolfram Research

Wolfram Research is a technology company specializing in computational intelligence and technical software. The organization is best known for its Mathematica software and the Wolfram Alpha knowledge engine.

Potential impact and organizational security

The alleged leak of source code and authentication credentials poses significant risks to the organization's intellectual property and operational security. When proprietary source code is exposed, it can provide a roadmap for future vulnerabilities. Furthermore, the exposure of data related to critical authentication systems, such as Bitwarden and Keycloak, could potentially lead to secondary attacks against both the organization and its users. Such secondary attacks often involve using stolen credentials to gain further access or to impersonate legitimate users.

As a United States-based entity, this alleged data breach may be subject to various state-level privacy laws and federal regulations regarding data protection and notification. While public information regarding the direwolf group remains limited, the diversity of the shared data types may indicate that the attack involved deep access to the organization's internal networks.

For organizations in the technology sector, maintaining robust defensive postures is essential to mitigate these risks. Common defensive steps include implementing multi-factor authentication (MFA) to protect sensitive credentials, maintaining strict network segmentation to prevent lateral movement, and conducting regular audits of access logs. Additionally, securing backups and ensuring that development tools and production databases are isolated from general user environments can help reduce the impact of a potential intrusion. Organizations must also stay vigilant regarding the evolving tactics of ransomware groups that target high-value intellectual property.