The Direwolf ransomware gang has added DXS International, a UK supplier of NHS-approved clinical decision support software, to its leak site. Ransomware trackers logged the listing on August 15, with ransomware.live dating the entry to 20:23 UTC and estimating the attack began the same day.
The claim, as quoted by GalaxyWarden, says Direwolf took internal data including customer and employee information, with at least one password field among the stolen records. No volume has been disclosed and the listing remains unconfirmed. DXS International has not issued a public statement, and ransomware.live flags the entry as a possible duplicate of an earlier listing for the company, which acknowledged a ransomware attack in December 2025.
DXS supplies clinical support content and referral tools used in NHS primary care, with products including BestPathway, ExpertCare, and the SMART Referral decision support system. A compromise at that layer matters because the company sits in the clinical data path for GP practices and pharmacies across England, and any stolen credentials could be reused against customer organizations that share accounts or federated access.
For NHS trusts and primary care organizations that use DXS products, the practical steps are to treat the claim as credible until disproven, reset any shared or vendor-managed credentials, watch for phishing built around leaked contact data, and confirm the vendor’s continuity plans. The repeat targeting of the same supplier also underscores how extortion groups cycle back to healthcare technology vendors whose customer lists have proven value.
