PayUp Data Breach

DireWolf ransomware has claimed PayUp as a victim, listing the company on its dark web portal on August 19, 2026. SOCRadar’s Dark Web Monitoring identified this listing. All associated stealer-log hits were confined to the domain auth.payup[.]com, indicating the focus of the credential harvesting efforts. PayUp operates in the financial services sector, providing payment and collections technology. Companies in this industry are particularly attractive to threat actors due to the sensitive financial data and payment credentials they handle, which can be rapidly monetized. The DireWolf ransomware group’s recent activity, as of August 19, 2026, also includes claims against Lifesum (Sweden, Healthcare Technology), InfoFlo CRM (US, Technology), and Photon Health, Inc. (US, Healthcare). This pattern suggests a deliberate campaign by DireWolf targeting organizations where the sensitivity of data can significantly amplify extortion leverage. A payment platform’s customer authentication records are a natural fit for this strategy, aligning with the group’s established targeting preferences for organizations holding valuable and sensitive information.

Stealer-log telemetry for payup[.]com revealed 16 customer credential records, all authenticated against auth.payup[.]com. The data freshness window for these records was between June 1 and August 15, 2026, ending just four days before the listing on the dark web. Notably, every identified record belonged to a consumer account rather than employee credentials, suggesting that the corporate identity layer was not a primary target for this specific harvesting operation. This concentration on consumer accounts indicates the attackers’ focus was on accessing user financial data. The observed 75-day sustained harvesting against a payment platform’s authentication portal strongly points towards phishing or credential stuffing attacks specifically targeting auth.payup[.]com. For any of the 16 compromised accounts that might store payment methods or have pending transactions, the potential exposure extends beyond simple account takeover to include the compromise of live financial data. This highlights the significant risk to both PayUp’s customers and the company itself. Continued dark web monitoring and proactive credential hygiene checks are recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.