Oportunidados appears on Direwolf leak site

Direwolf added Oportunidados, a Brazilian company, to its leak site, according to ransomware.live, FalconFeeds.io and GalaxyWarden. The listing was logged with an estimated discovery date and attack date of September 1, 2026. So far, there is no independent confirmation of a breach or any verified exfiltration.

What did the ransomware trackers record?

The monitoring panels and catalogs agree that Oportunidados was added to Direwolf's publication ecosystem. Ransomware.live listed it on its tracking dashboard with a discovery date of 2026-09-01 and an estimated attack date of 2026-09-01. FalconFeeds.io also reported that Dire Wolf added three new victims to its leak site, including Oportunidados of Brazil.

What did the threat intelligence sources say?

GalaxyWarden opened a dedicated entry titled "Oportunidados Listed by Direwolf Ransomware Group" and said it was a public listing on Direwolf's leak site tracked through threat intelligence sources. The same entry stressed that the affected organization had not confirmed the intrusion, and that neither the exfiltration nor the group's claims had been independently verified.

How strong is the attribution?

HookPhish's reference should be read as an alert based on the actor's post, not as independent confirmation of the incident. HookPhish published an entry titled "Ransomware Group direwolf Hits: Oportunidados," naming Oportunidados as the target organization, the site oportunidadeos.com.br, country BR and the date September 1, 2026. That framing keeps the case within the bounds of a post attributed to the group, with no official validation visible in the material provided.

The available information is enough to show that Oportunidados was publicly named by Direwolf and echoed by several monitoring sources, but not enough to confirm the real scope of the incident or the technical attribution.