Ransomware Group Direwolf Claims Attack on UK Grocery Software Firm My Cloud Grocer
The criminal gang posted the British e-commerce software company on its dark-web listing site on 1 November 2026. My Cloud Grocer has not publicly confirmed any incident.
Key points
- Direwolf, a ransomware group, listed UK-based My Cloud Grocer on its dark-web leak site on 1 November 2026, claiming responsibility for an attack on the e-commerce software company.
- My Cloud Grocer has not publicly confirmed any breach, and the claim could not be independently verified at publication time.
- Leak-site listings are written by criminals to pressure targets into paying and are sometimes exaggerated or outright false.
- Retail and e-commerce attacks have appeared on our radar more frequently lately: we've covered three e-commerce stories in the last 90 days, including Qilin's unverified claim against a Colorado restaurant supplier on 22 October.
A ransomware group called Direwolf claimed on 1 November 2026 that it had attacked My Cloud Grocer, a British company providing cloud-based software for grocery retailers. The monitoring service Ransomware.live first observed the listing that day.
Direwolf runs a dark-web leak site, a page in a hidden part of the internet where the group names companies it says it has attacked, typically to pressure them into paying a ransom. The group's post described the alleged target category only as "Software." No further detail about the scope of the claimed intrusion appeared in the listing.
How active is Direwolf?
Active enough to watch. Direwolf has been listed among groups tracked by leak-site monitors, though Threat Vectr doesn't hold independently verified figures on its total claimed victims. What's clear from the listing itself is the group's intent: name a target publicly, apply pressure, wait.
These claims reflect what criminals publish, not confirmed breaches.
Should you worry about unverified listings?
They're worth taking seriously as a prompt to act, not as proof anything happened. Criminals sometimes use news of an alleged breach, confirmed or not, to run follow-up scams regardless of whether the underlying claim is true.
What should My Cloud Grocer customers and staff do right now?
Take sensible precautions. Watch for phishing emails: fake messages pretending to come from the company or a partner, asking you to click a link or hand over login details. Be sceptical of phone calls claiming to offer "breach compensation" or asking you to verify your account. Don't reuse passwords across services. If you use the same password on My Cloud Grocer's platform as elsewhere, change it on those other accounts now.
My Cloud Grocer has made no public statement about the listing, and no confirmation of any incident exists at publication time.
