DireWolf
Data as of September 15, 2026.
Credential exposure before the attack
12% of DireWolf victims whose domain we can identify (16 of 133) had employee credentials leak in the 12 months before DireWolf named them as a victim.
We don't know whether any of these credentials were how DireWolf gained initial access.
What industries DireWolf targets
Sector identified for 103 of 133 victims.
| Healthcare | 22 | |
| Manufacturing | 19 | |
| Financial Services | 15 | |
| Logistics | 9 | |
| Technology | 9 | |
| Construction | 8 | |
| Legal | 7 | |
| Education | 5 |
Where the victims are located
Country identified for 118 of 133 victims.
| United States | 30 | |
| Malaysia | 9 | |
| United Kingdom | 9 | |
| Thailand | 8 | |
| Brazil | 6 | |
| Taiwan | 5 | |
| Turkey | 5 | |
| Singapore | 4 |
Most recent DireWolf victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Hazel Health hazel.co | Healthcare | United States | Sep 15, 2026 |
| Little Otter littleotterhealth.com | Healthcare | United States | Sep 15, 2026 |
| Port of Tanjung Pelepas ptp.com.my | Logistics | Malaysia | Sep 14, 2026 |
| RelyComply relycomply.com | Technology | South Africa | Sep 10, 2026 |
| EMS1R ems1r.com | Healthcare | United States | Sep 9, 2026 |
| Sales Boomerang salesboomerang.com | Financial Services | United States | Sep 9, 2026 |
| Lightcast lightcast.io | Not identified | Not identified | Sep 8, 2026 |
| Precision Vehicle Logistics precisionvehiclelogistics.com | Logistics | United States | Sep 8, 2026 |
| Semper Laser semperlaser.com | Healthcare | United States | Sep 8, 2026 |
| TrainMe trainme.co | Not identified | France | Sep 8, 2026 |
| eAssist Dental Solutions dentalbilling.com | Healthcare | United States | Sep 7, 2026 |
| Mission Pet Health missionpethealth.com | Not identified | United States | Sep 7, 2026 |
| myLaurel mylaurelhealth.com | Healthcare | United States | Sep 7, 2026 |
| Wolfram Research wolfram.com | Technology | United States | Sep 7, 2026 |
| Cartrack cartrack.co.za | Financial Services | South Africa | Sep 3, 2026 |
| PTT Oil and Retail Business Public pttor.com | Energy | Thailand | Sep 3, 2026 |
| Honeycomb Insurance honeycombinsurance.com | Financial Services | United States | Sep 2, 2026 |
| PT Intraco Penta intracopenta.com | Construction | Indonesia | Sep 2, 2026 |
| Oportunidados oportunidados.com.br | Not identified | Brazil | Sep 2, 2026 |
| Erdem Hospital erdemhastahanesi.com.tr | Healthcare | Turkey | Aug 31, 2026 |
Showing the 20 most recent of 133. Browse recent data breaches for more.
DireWolf leak sites
Addresses we've seen DireWolf publish victims from. Any .onion address needs the Tor Browser.
direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.oniondirewolfgpyqohwxwoetsz7a6p72diu32c3wfysqdx4ei6bwft7zh3yd.onion
DireWolf questions
Is DireWolf still active?
Yes. DireWolf posted its most recent victim on September 15, 2026. That's 51 victims in the last 30 days.
How many victims has DireWolf claimed?
DireWolf has named 133 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 94 of them were posted in the last 12 months.
When did DireWolf first appear?
The first victim we recorded for DireWolf was posted on May 28, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does DireWolf target?
Healthcare accounts for the most victims we can classify, with 22. Manufacturing follows at 19. We could identify a sector for 103 of 133 victims, so treat this as the shape of the targeting rather than a full census.
Has DireWolf already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.