Interseguro Data Breach

On October 13, 2026, the DireWolf ransomware group claimed Interseguro as a victim, posting the company on their leak site. Concurrently, stealer-log data sampled by SOCRadar revealed fresh credentials for Interseguro’s customer portal, interseguro[.]pe, with insertion dates matching the ransomware publication date. Interseguro is a financial services and insurance organization based in Peru. The group’s targeting pattern includes financial sector entities in Latin America, with a particular focus on Peru and neighboring countries, frequently leveraging customer-facing portals for extortion. This temporal correlation between leaked credentials and a ransomware claim significantly elevates the urgency, suggesting a possible link between the credential exposure and the initial access used by DireWolf. DireWolf has demonstrated a consistent focus on the financial sector across Latin America in the 60 days preceding this claim. Interseguro aligns perfectly with the group’s typical victim profile: a financial services entity in Peru that utilizes customer portals, which are often targeted by DireWolf for extortion. The same-day emergence of fresh customer portal credentials in underground markets, coinciding with the ransomware group’s public claim, presents a critical threat intelligence indicator. While direct attribution of these specific logs to DireWolf’s initial access remains unconfirmed, the immediate availability of customer portal credentials in the criminal underground underscores the severity of this exposure, surpassing many typical leak-site listings.

SOCRadar’s threat intelligence platform flagged interseguro[.]pe in stealer-log data sampled prior to the ransomware claim. The query yielded 25 credentials, all targeting the Interseguro customer portal at interseguro[.]pe. Notably, the most recent records associated with these credentials carried an insert date of October 13, 2026, aligning precisely with the date the ransomware group posted their claim. The concurrent appearance of fresh stealer-log data and a ransomware claim on the same day suggests two primary possibilities: either the credential harvesting occurred simultaneously with the ransomware deployment, or the credentials were harvested and sold in near real-time, potentially enabling initial access shortly before the claim was published. Regardless of the exact sequence, this temporal overlap is a significant threat intelligence indicator. While the direct link between these specific logs and DireWolf’s initial access is unconfirmed, the freshness of the customer portal credentials found in underground markets intensifies the urgency of this exposure. The timely availability of customer portal credentials demands immediate incident response. Interseguro’s customers should prioritize resetting their credentials and actively monitoring their accounts for any signs of unauthorized access. The organization itself should initiate a thorough forensic review of customer authentication logs from October 13, 2026, and preceding days, specifically looking for patterns indicative of credential stuffing or account takeover attempts. This review needs to commence without delay to mitigate further potential impact.