Loading story…
The DireWolf ransomware group has allegedly compromised the U.S. National Kidney Registry and listed the nonprofit on its leak site, claiming to have exfiltrated 253 GB of data across about 180,000 files. The purported haul includes donor and recipient medical records and internal documents; however, the claim remains unverified because the group has not released samples or screenshots. DireWolf reportedly said it did not disrupt registry operations and set an alleged 11-day deadline for the organization to enter payment negotiations.
A disruption to transplant coordination could affect tissue matching, laboratory work, scheduling, logistics, and communications, potentially delaying care, increasing the chance of errors, and endangering patients during a prolonged outage. Stolen transplant data could also support persistent fraud and extortion. Health-sector organizations should prioritize strong identity and access management, network segmentation, tested isolated backups, and incident-response exercises that include executive and clinical leadership.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
DireWolf emerged as a financially motivated ransomware group.
DireWolf listed the U.S. National Kidney Registry on its leak site and alleged that it exfiltrated 253 GB of data across roughly 180,000 files, including donor and transplant-recipient records. The claims had not been independently verified, and the group provided no samples or screenshots.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Biopharmaceutical company **Diater** has been listed on the dark-web leak site of the **DeadLock** ransomware group, in an incident that could expose highly sensitive information tied to patients and healthcare professionals. Reporting indicates the attackers are using a **double-extortion** model, combining data theft with encryption, and that records retained by Diater for up to 10 years may be at risk of public release. The attackers reportedly claim to have stolen directories containing user folders, documents, `QM` files, and material linked to **EDICOM**, although the ransom demand, intrusion date, and full scope of exfiltration have not been disclosed. DeadLock, a ransomware operation first observed in mid-2025 and associated with Russian-origin actors, is known for appending the `.dlock` extension to encrypted files, adding to concerns that the Diater incident could affect both operational systems and long-term medical data confidentiality.
Aug 1, 2026
The University of Hawaiʻi Cancer Center confirmed a **ransomware-driven data breach** affecting its epidemiology division, with the potential exposure of data tied to up to **1.2 million individuals**. The university reported that attackers accessed files containing **SSNs and driver’s license numbers** sourced from historical Hawaiʻi DOT records and Honolulu voter registration data (dating back to 1998), as well as health-related research data connected to the **Multiethnic Cohort (MEC) Study** and other diet-and-cancer studies; the incident was discovered on **August 31, 2025**, and the university acknowledged it engaged with the threat actors while restoration and impact assessment were underway. Separately, a “cyber incident” caused a **five-school-day internet outage** at the Denmark School District in Wisconsin; the **INC Ransom** group claimed the victim on its leak site, alleging both **encryption** and theft of roughly **70.76 GB** of data, though the district had not publicly confirmed ransomware or data exfiltration. In the healthcare sector, **Insight Hospital and Medical Center** in Chicago reported unauthorized network access between **August 22 and September 11, 2025**, and the **Termite** group later claimed to have stolen and then **leaked ~360 GB** (about 900,000 files) of “confidential data,” including medical imaging files (e.g., `.dcm`), raising the likelihood of exposure of both identity data and protected health information.
Jun 29, 2026
NHS Dumfries and Galloway disclosed a cyberattack that raised the risk of patient data exposure, and weeks later stolen records linked to the incident were published online as part of an extortion campaign. Reporting indicated that highly sensitive files involving children’s health information were among the leaked material, escalating the impact from service disruption to a serious confidentiality breach affecting vulnerable patients. The incident fits a broader pattern of ransomware and extortion operations targeting healthcare providers, where attackers disrupt clinical systems and use stolen data to pressure victims. Similar attacks previously hit New Zealand’s Waikato District Health Board, where a ransomware intrusion crippled hospital IT, forced lengthy restoration from backups across hundreds of servers and thousands of workstations, and underscored that healthcare organizations remain high-value targets because outages and data theft can directly affect patient care.
Jun 29, 2026