Direwolf Lists Oportunidados on Leak Site

Update September 10, 2026: New intelligence panels added Oportunidados as a claimed Direwolf victim and narrowed the case window to September 1 and 2, 2026. Darkfield/Orizon also added a critical-severity label and a report of confirmed exfiltration of a large volume of data, although the effective leak date still has no verified timestamp.

Direwolf added Oportunidados, a company based in Brazil, to its leak portal, according to ransomware.live, FalconFeeds.io and GalaxyWarden. The listing was logged with estimated discovery and attack dates of September 1, 2026. So far, there is no independent confirmation of the intrusion or of any verified exfiltration.

What did the ransomware aggregators record?

The monitoring panels and catalogs agree that Oportunidados was added to Direwolf's publication ecosystem. Ransomware.live listed it in its tracking panel with a discovery date of 2026-09-01 and an estimated attack date of 2026-09-01. FalconFeeds.io also reported that Dire Wolf added three new victims to its leak portal, including Oportunidados from Brazil.

BreachSense later added Oportunidados to its breach catalog as a victim claimed by Direwolf, with the domain oportunidadeos.com.br and a discovery date of September 2, 2026. At the same time, Darkfield/Orizon logged it as a Direwolf victim with a leak-site listing on September 1, 2026 and a critical severity rating, while distinguishing between the publication date and an effective leak date that remains unknown.

What did the threat intelligence sources say?

GalaxyWarden opened a dedicated file titled "Oportunidados Listed by Direwolf Ransomware Group" and clarified that it is a public listing on Direwolf's leak site tracked through threat intelligence sources. The same file noted that the affected organization did not confirm the intrusion and that neither the exfiltration nor the group's claims were independently verified.

Darkfield/Orizon went further in its technical description and said the case would involve a confirmed exfiltration of a massive PII dataset. According to that record, the material would include more than 28 million Brazilian individuals linked to corporate identities through CNPJ, along with millions of expanded business profiles, thousands of user accounts and credentials, including password hashes, OAuth and API tokens, and session data.

BreachSense, by contrast, described Oportunidados only as a Brazil-based B2B cloud platform for market intelligence and lead prospecting, focused on business data and commercial intelligence. Its file provides business context, but does not detail the technical scope of the alleged breach or the number of people affected.

How solid is the attribution?

HookPhish's reference should be read as an alert based on the actor's publication, not as independent confirmation of the incident. HookPhish published a post titled "Ransomware Group direwolf Hits: Oportunidados," listing Oportunidados as the target organization, the site oportunidadeos.com.br, country BR and date September 1, 2026. That framing keeps the case within the scope of a group-attributed publication, still without visible official validation in the material provided.

CYBERCRIME.works also listed Oportunidados in Direwolf's section, classified it as a Business Services organization in Brazil and associated it with the domain oportunidadeos.com.br. The case appears as "Published" seven days before the latest update, which places the initial listing around September 1, 2026.

Across the different tracking panels, including BlueThreat, Ransomnews, CYBERCRIME.works and BreachSense, there is a clear timing overlap. All of them place Direwolf's claim against Oportunidados around September 1, 2026, with first-seen dates between September 1 and 2. That alignment reinforces that the leak-site listing and the group's claim happened in that window, although none of those sources amount to official breach confirmation from the organization or a CERT.

The available information is enough to support that Oportunidados was publicly named by Direwolf and echoed by multiple monitoring sources, but not enough to confirm, with independent backing, the true scope of the incident or the technical actor behind it.