Direwolf Claims Ransomware Attack on PayrHealth

Summary

A ransomware.live monitoring post attributes a ransomware attack claim against US healthcare organization PayrHealth to Direwolf. The post alleges encrypted data and healthcare operational disruption; the claims are unconfirmed.

Key points

The monitored post names PayrHealth, a US healthcare organization, as the claimed victim and Direwolf as the actor.
The post attributes the claim to a Direwolf publication and is marked as monitored by ransomware.live.
The post alleges encrypted data and disruption to healthcare operations; these claims are not independently confirmed.
The record lists August 15, 2026, as the discovery and publication date.

Article Details

Victim: PayrHealth
Victim Domain: Not disclosed
Encryption Status: The article reports encrypted data as part of the ransomware group's claim; the claim is unconfirmed by the victim.
Encrypted Size: Not disclosed
Exfiltration Status: Unknown
Exfiltrated Data: Not disclosed
Exfiltrated Size: Not disclosed
Ransom Demand: Not disclosed
Leak Status: Unknown; the article does not report that victim data was leaked or published.

Threat Actors

DireWolfIdentified as the ransomware actor that claimed to have targeted PayrHealth; the article says the claim is unconfirmed.

Countries

United StatesPayrHealth was targeted in a ransomware attack by the actor Direwolf in the United States, affecting the healthcare sector.

Industries

HealthcarePayrHealth, a US healthcare organization, was targeted by the direwolf ransomware threat actor, resulting in encrypted data and disruption of healthcare operations.