cyfenced.com →

[ Ransomware claim · direwolf · 13 Oct 2026 ]

Interseguro

The ransomware group direwolf named Interseguro (Peru) on its leak site on 13 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.

Confirmed by the organisation Financial Services

[ Status ]Has the attack been confirmed?

In October 2026 Interseguro told clients by email that a third party had accessed information on a group of its clients without authorisation, that it had contained the incident, and that the data did not allow transactions or insurance operations to be carried out.

[ The organisation ]Who is Interseguro?

What it does
Interseguro is a Peruvian insurance company that belongs to the Intercorp group. It offers life insurance, annuities and pensions (rentas vitalicias), SOAT compulsory motor accident cover and travel insurance, and describes itself as a long-standing leader in the Peruvian annuities market.
Based in
Peru
Founded
1998
Size
more than 2.7 million clients, according to the company's website
Who it serves
Individuals and families in Peru who buy life, travel and compulsory motor cover, and retirees who receive annuity and pension payments from the company.

Partners and customers it names publicly

  • Intercorp, Peruvian business group that Interseguro belongs to

[ Impact ]Who could be affected

Policyholders, retirees receiving annuity payments and people covered by its SOAT and life policies could be affected if personal or policy information was exposed. The company has said that policies, cover, claims handling and benefit payments continue as normal, but clients could face a higher risk of phishing and fraud attempts that use the incident as a pretext.

In financial services generally: Clients can be targeted with fraud and phishing that uses their account details, and payments or advice can be interrupted.

[ The attacker ]About direwolf

Dire Wolf is a ransomware group first seen in May 2025 that uses double extortion, encrypting systems and threatening to publish stolen data on a leak site. Security researchers report that it stops backup and security processes, deletes backups and clears event logs before encryption, and has targeted manufacturing, technology, construction and finance organisations in many countries.

direwolf has claimed 4 organisations in the last 30 days, most in United States, United Kingdom and Mexico, and mostly in financial services, retail & e-commerce and energy & utilities.

direwolf on Ransomware.live

Other organisations direwolf has named

[ What to do ]If you are a customer, partner or neighbour

  1. Treat unexpected emails, calls or messages that mention your Interseguro policy, annuity or the incident with caution, and contact the company only through the contact details on its official website.
  2. Never share passwords, card numbers or one-time codes with anyone who contacts you claiming to be from Interseguro or Interbank.
  3. Check your bank and annuity payment statements for anything unusual and report concerns to your bank and to Interseguro.
  4. Send questions about whether your data is involved to the address Interseguro has published for this purpose, servicio@interseguro.com.pe.
Researched with AI from the sources on this page on 26 Oct 2026. Facts can change: check the organisation's own announcements.