A ransomware group calling itself Direwolf has claimed on its dark-web leak site to have carried out an attack against PayrHealth, with the claim dated August 15, 2026. This claim was tracked by ransomware.live, a security research platform that monitors ransomware groups’ public leak sites, and has not been independently verified. PayrHealth has not issued any public statement confirming a breach, and no regulator has confirmed the incident at this time.
What we know — and don’t
- Direwolf’s leak-site posting lists a claimed attack date of August 15, 2026.
- PayrHealth operates in the healthcare sector, working with healthcare providers on payer-related services.
- The specific types of data the group claims to have obtained have not been disclosed by Direwolf or confirmed by any independent source.
- No official confirmation from PayrHealth or from any regulatory body has been reported as of this writing.
- Claims made on ransomware leak sites are self-reported by the criminal group and are not proof that an intrusion actually occurred.
What should you do if you have an account with this company?
- Change your password for any account associated with PayrHealth, and avoid reusing that password elsewhere.
- Enable two-factor authentication (2FA) on the account if it is offered, and on your email account as well.
- Be alert for phishing emails, texts, or calls that reference PayrHealth, healthcare billing, or insurance matters — attackers often use claimed breaches to craft convincing lures.
- Avoid clicking links or downloading attachments from unexpected messages claiming to be from PayrHealth or related healthcare partners.
- Consider signing up for a service like Aura or LifeLock to help monitor for signs your personal information is being misused, since healthcare-related data can be attractive to identity thieves.
- Keep an eye on medical billing statements and insurance explanations of benefits for any unfamiliar activity.
BreachLetter will update this page if PayrHealth confirms this incident, if new information emerges from Direwolf’s claim, or if the matter is officially reported to regulators.