Interseguro reports unauthorized access to systems

Update Oct. 16, 2026: SBS said it is carrying out follow-up and supervisory actions over a possible data leak at Interseguro. The insurer, meanwhile, is still validating the scope, volume, and details of the compromised information.

Interseguro detected unauthorized access on Oct. 7 to information stored in its systems. In its public statement, the incident was limited to its own infrastructure and did not affect other companies in the holding group. The insurer also said policies, coverage, claims handling, and benefit payments were still operating normally.

What did Interseguro say about the compromised data?

The company said that, based on the analysis completed so far, the information involved was mainly identification data, contact details, and policy numbers. It also said it had taken containment steps and was carrying out measures to strengthen its security controls and reduce any possible impact.

What is attributed to the Dire Wolf group?

Infobae reported that the Peruvian insurer was listed by the Direwolf ransomware group on a dark web extortion portal. According to that version attributed to the group, internal documents, source code, database backups, and personal records would have been obtained, although the scope of the alleged leak had not been independently confirmed.

Available reports also say Dire Wolf attributed an estimated 2.5 terabytes to the incident, but that figure was not confirmed by Interseguro or by any independent source. For now, that figure should be read as a claim from the group itself, not as a verified measure of the incident.

What is known about the ransomware actor?

Picus Security describes Dire Wolf as a Windows ransomware family whose operators combine data theft and encryption. The firm cites possible entry points such as phishing, exposed RDP or VPN services, compromised credentials, and third-party access, although its analysis does not link those techniques to the Interseguro case.

At this stage, the public picture combines a confirmed notice of unauthorized access from the insurer with a dark web extortion claim that still lacks independent verification. No specific, documented TTPs have been identified for this incident.