Osmo Wallet

The ransomware group Direwolf has claimed responsibility for a cyberattack on Osmo Wallet, a digital financial services company operating the domain osmomoney.com. According to our investigation team, the listing covers 229,686 records associated with the company, and the attack is estimated to have occurred on August 10, 2026. The same day, Direwolf added Osmo Wallet to its leak site and warned that it would publish the stolen data unless the company entered negotiations. DeXpose reported the group's statement as reading, "The full leak will be published soon, unless a company representative contacts us via the channels provided." Independent trackers, including ransomware.live and BreachSense, also recorded the claim.

Limited public reporting: As of September 25, 2026, detailed company notices or major news coverage for this listing were limited in sources reviewed. The facts below rely primarily on the indexed fields plus any secondary sources cited.

Some sources describe Osmo Wallet as a Guatemala-based fintech offering multi-currency balances, international transfers, virtual Visa debit cards, and Bitcoin transactions. HookPhish listed the company as US-based, so its exact country of operation is not fully consistent across sources reviewed.

Breach Timeline

August 10, 2026: Direwolf listed Osmo Wallet on its leak site, with trackers recording the discovery that day, and the group threatened to publish stolen data unless the company negotiated.

August 10, 2026: DeXpose reported the group's claim of responsibility and its public warning to the company.

What Information Was Compromised?

Our analysis found the following data types in this breach: phone numbers for all 229,686 indexed records, email addresses for 203,483 records, names for 132,275 records, birthdays for 4,808 records, and street addresses for 2,490 records.

Not every individual is affected by every type of data listed here.

We did not find confirmation of what, if any, financial account details, identification numbers, or passwords were included, and the group's leak site did not itemize the stolen data in sources reviewed as of September 25, 2026.

What Are the Potential Risks for Affected Individuals?

Because this breach involves a financial services company, the combination of names, phone numbers, and email addresses is useful to criminals even without account credentials. With this information, scammers can craft convincing phishing emails, texts, or phone calls that appear to come from Osmo Wallet or from a person's own bank. Calls that reference a real name and phone number are far more persuasive than generic spam.

If birthdays and street addresses were exposed for affected individuals, those details can support identity fraud, account takeover attempts, and targeted scams such as fake delivery notices or urgent payment requests. People who reuse passwords across services face added risk if any credentials were included in the stolen data, though this remains unconfirmed.

What Should You Do If You Were Affected?

If you used Osmo Wallet or received communications tied to osmomoney.com, take these steps:

Be suspicious of unexpected emails, texts, or calls claiming to be from Osmo Wallet, especially any asking you to verify your identity, reset a password, or move funds. Contact the company through its official website or app rather than replying directly.

Change your Osmo Wallet password if you have an account, and change it anywhere else you reused the same password.

Turn on two-factor authentication for your financial accounts where it is offered.

Monitor your bank and card statements for transactions you do not recognize, and report anything unusual promptly.

Treat any message referencing your name, phone number, or address with caution, even if the details are accurate, because those details may have come from this breach.