Direwolf added two health-tech companies to its leak site within a minute of each other on August 19, claiming data theft from e-prescribing marketplace Photon Health and Swedish nutrition app Lifesum.
Ransomware.live logged both listings with estimated attack dates of the same day and flagged data exfiltration for each. RansomLook mirrored the pair, and GalaxyWarden rated both high severity while noting the claims are unverified. Neither company has publicly confirmed an intrusion.
Photon Health runs a prescription marketplace that lets prescribers, pharmacies, and payers compare drug pricing in real time, positioning itself as modern prescribing infrastructure for health systems, urgent care clinics, and digital health platforms. Lifesum, a Stockholm-based wellness app, tracks diet, weight, and health goals for millions of users, making its backend a rich target for personal health data.
The two listings land as Direwolf continues a healthcare-focused spree that has already included ECG device maker AliveCor, Spain’s Quironsalud hospital group, and NHS software supplier DXS International.
Health-tech firms holding prescription routing or wellness data should treat the pattern as a warning: verify multi-factor authentication on remote access, segment platforms from corporate networks, and test restoration from offline backups before a listing turns into a leak.
