Interseguro reports unauthorized access to systems

Update October 16, 2026: The SBS said it is monitoring the case and taking supervisory actions over the possible Interseguro data exposure. The insurer is still validating the scope, volume and details of the compromised information.

Interseguro detected unauthorized access to information stored in its systems on Oct. 7 and said the incident was limited to its own infrastructure, without affecting other companies in the holding group. The insurer also said policies, coverage, claims handling and benefit payments were still operating normally.

What did Interseguro say about the compromised data?

The company said that, based on its analysis to that date, the information involved was mainly identification data, contact details and policy numbers. It also said it had taken containment measures and was carrying out actions to strengthen its security controls and reduce any possible impact.

What is being attributed to the Dire Wolf group?

Infobae reported that the Peruvian insurer was included by the Direwolf ransomware group on a dark web extortion portal. According to that version attributed to the group, internal documents, source code, database backups and personal records would have been obtained, although the scope of that alleged leak had not been independently confirmed.

Available reports also say Dire Wolf attributed an approximate volume of 2.5 terabytes to the incident, but that figure was not confirmed by Interseguro or by an independent source. For now, the number should be read as a claim from the group itself, not as a verified measure of the incident.

What is known about the ransomware actor?

Picus Security describes Dire Wolf as a Windows ransomware family whose operators combine data theft and encryption. The firm cites phishing, exposed RDP or VPN access, compromised credentials and third-party access as possible entry points, although its analysis does not link those techniques to the Interseguro case.

At this point, the public picture combines a confirmed notice of unauthorized access from the insurer with a dark web extortion attribution that remains unverified independently. No specific, documented TTPs were identified for this incident.

What does Vecert have to do with the Interseguro case?

Vecert is not identified in the public communication included in this note, so there is no basis to assign it a confirmed role in the incident. What is verified is that Interseguro reported unauthorized access on Oct. 7 and that the SBS followed the case while the insurer validates the scope.

In the available information, the public version of the incident remains centered on Interseguro, the possible data leak and the attribution made by the Dire Wolf group. Until Vecert is mentioned in verifiable primary sources or in an official communication, it should not be linked to the case as a confirmed actor.