DireWolf Ransomware Gang Targets National Kidney Registry, Threatening Patient Safety
The DireWolf ransomware gang claims to have stolen 253 gigabytes of sensitive data from the National Kidney Registry, raising critical concerns about patient safety and the security of vital organ transplant operations.
A cybercrime group known as DireWolf has allegedly targeted the National Kidney Registry (NKR), a key facilitator of organ transplants in the United States, according to multiple ransomware monitoring sites. The gang claims to have exfiltrated approximately 253 gigabytes of data, which could include sensitive information about potential organ donors, recipients, their medical histories, and transplant suitability.
This incident underscores the profound risks faced by third-party suppliers within the healthcare ecosystem. Experts emphasize that attacks on organizations like the NKR, which manage critical life-saving services, can have direct and severe consequences for patient care. "In healthcare, cybersecurity is patient safety," stated Errol Weiss, chief security officer at the Health Information Sharing and Analysis Center. "If an attack disrupts transplant coordination - tissue matching, labs, scheduling, logistics, communications - care slows, becomes more error-prone, and in extreme, prolonged outages, people could die."
DireWolf reportedly stated that its operation involved data theft rather than a disruption of the NKR's IT infrastructure. As of Thursday, the NKR was no longer listed as a victim on some monitoring sites, suggesting potential negotiations or a resolution between the organization and the cybercriminals. The National Kidney Registry has not yet responded to requests for comment regarding the specific claims made by DireWolf.
Attacks targeting healthcare suppliers, including medical device manufacturers, pharmaceutical companies, and clinical laboratories, have been on the rise. However, incidents affecting organizations that facilitate essential life-saving products, such as organs or blood, present a particularly grave scenario. "These organizations may hold highly sensitive clinical, donor, recipient and matching information involving people at an exceptionally vulnerable point in their lives," explained Dave Bailey, vice president of solutions and strategy at Clearwater, a healthcare privacy and security consultancy.
Bailey further noted that attackers can leverage such sensitive data to exert pressure on multiple fronts: threatening operational disruption, potential patient harm, regulatory penalties, and the public exposure of deeply personal information. Weiss added that transplant-related records are particularly valuable to cybercriminals due to their sensitivity and the intense time pressure involved, knowing that these organizations cannot afford significant downtime.
This incident echoes a broader trend of attacks impacting the healthcare supply chain. Earlier in 2026, a series of cyberattacks on blood suppliers prompted a joint warning from the American Hospital Association and Health ISAC. Rex Ahlstrom, chief strategy officer at Tecsys, a healthcare supply chain company, stressed the need for healthcare leaders to proactively map critical suppliers and assess their own operational resilience in the event of disruptions.
For organizations like blood suppliers and organ transplant facilitators, where no direct substitutes exist and inventory is limited, advance planning is crucial. This includes establishing clear manual processes and communication channels for system outages, ensuring that critical functions can continue even when digital systems are compromised. The worst time to discover a critical supply chain partner lacks alternatives is during an active outage.
Weiss advises that organizations in this sector should prioritize bolstering controls that minimize the impact of attacks and accelerate recovery. Key measures include robust identity and access management, network segmentation, and regularly tested, isolated backup systems to ensure business continuity and protect patient data.