The Direwolf extortion group has posted the National Kidney Registry on its leak site, claiming to have stolen internal data from the nonprofit that runs the largest living-donor kidney exchange in the United States.
Trackers logged the listing on August 25. The claim is unconfirmed, and the group has not published volumes or described the types of records it holds. The registry matches living donors with transplant patients through paired donation chains and stores highly sensitive donor and recipient medical information.
Direwolf has cycled through medical targets all summer, listing a medical billing firm, telehealth providers, an ECG device maker, and an NHS clinical software supplier in previous months. The kidney registry post is part of a wave of healthcare listings across extortion groups in recent weeks.
Organizations in the donation and transplant space should treat the listing as a signal to review vendor access and monitor whether notification obligations are triggered. Donors and recipients whose records may be involved should expect a letter from the registry if its investigation confirms exposure.
