Interseguro confirms unauthorized access

Update Nov. 2, 2026: Interseguro clarified that the unauthorized access was detected on Oct. 7, 2026. That detail, now confirmed, has been added to the article, along with the earlier references to the scope of the incident and the claims published by ransomware groups.

Interseguro said it detected unauthorized access to information stored in its systems on Oct. 7, 2026. The company blocked the compromised access, rotated credentials and security keys, and strengthened infrastructure controls. It said the incident was limited to its own systems and that it notified the relevant authorities and customers whose data may have been affected.

What information did Interseguro say may have been compromised?

Interseguro said its analysis showed the data involved was mainly identification, contact, and policy number information. It also said policies, coverage, claims handling, and benefit payments continued to operate normally.

The insurer, which is part of Intercorp, also said the case remained under review and that it had reinforced its internal controls after the discovery. The statement did not publicly explain how the initial access occurred or attribute the incident to any specific group.

What did the ransomware groups say?

Nightspire listed Uruguay's Association of Notaries on its leak site as a victim, but the source that reported the entry did not independently confirm the intrusion or any data theft. The material describes the organization as Uruguay's national association of notaries.

In parallel, Direwolf allegedly added Interseguro to an extortion portal and claimed to have obtained confidential information. According to the source, that claim mentioned roughly 2.5 terabytes, internal files, and personal records, although none of those details has been independently verified.

What can be confirmed today about these two claims?

Based on the information available, only two recent mentions on ransomware-related sites can be confirmed, one tied to Uruguay's Association of Notaries and another to Interseguro. In both cases, the data posted by the actors or tracking sites is not enough to independently confirm the intrusion, its real scope, or any exfiltration.

In Interseguro's case, there is a formal acknowledgment of unauthorized access and a preliminary description of the type of data that may have been exposed. In the Uruguayan case, the entry observed on the leak site did not provide sufficient independent evidence about the incident or about specific TTPs.