Peru Insurer Data Breach Draws Scrutiny

A Peru insurer data breach is now under review by the country’s financial regulator. On Thursday 15 October the regulator said that Interseguro, a Lima insurer, formally reported an alleged theft and exposure of customer information.

Interseguro belongs to Intercorp Financial Services, a Peruvian financial group whose shares trade in New York under the ticker IFS. The case matters to US investors and to anyone with a Peruvian policy because the insurer has not yet said how many customers were hit.

El Comercio, a Lima daily, reports that the Peru insurer data breach began with unauthorized access Interseguro detected on Wednesday 7 October. The insurer says it stopped the access, opened an investigation and reported the incident to the competent authorities.

According to the company, the exposed records mainly contain identification data, contact data and policy numbers. It says the files hold nothing that would let anyone carry out transactions on a policy.

Several customers reported receiving an email about the incident on Sunday 11 October, according to Infobae, a Peruvian news site. The company says policies, coverage, claims handling and benefit payments continue normally.

Interseguro also says it renewed credentials and security keys and brought in international specialists. It says the attack happened in its own systems and did not involve other companies in its group.

An alert posted on X on Tuesday 13 October said a group called Direwolf had listed Interseguro on its extortion site. Such dark-web pages name victims and threaten to publish stolen files.

Direwolf claims it took about 2.5 terabytes of data, according to El Comercio and Infobae. Infobae adds that the group says the files include internal documents, source code, database backups and personal records.

The same alert suggests the material could include national ID numbers, mandatory traffic-accident insurance records and financial data. Interseguro declined to comment on what criminals post on the dark web.

None of these claims has been confirmed, and the insurer’s own description of the data is narrower. The gap between the two accounts is the main open question in the case.

El Comercio reported on 15 October that the SBS, Peru’s banking, insurance and pension regulator, was formally notified of the Peru insurer data breach. The SBS said it is already carrying out follow-up and supervisory actions.

The regulator is gathering information on the origin of the incident, the compromised data, the forensic results and the prevention measures. It will then assess whether Interseguro met the rules on information security and cybersecurity.

Indecopi, Peru’s consumer protection agency, said it is following the case and had received four complaints by Thursday afternoon, according to El Comercio. It said the facts fall under personal data protection, which is handled by a data authority inside the Ministry of Justice.

The Peru insurer data breach is not the first data scare at an Intercorp company. Peru Retail, a Lima trade site, recalls that Interbank, the group’s bank, confirmed unauthorized access to information in October 2024.

Intercorp Financial Services reported in its annual report that it owned 99.85% of Interseguro and 99.31% of Interbank at the end of 2025. Interseguro earned net income of 274.5 million soles (about US$80 million at 3.44 soles to the US dollar on 16 October 2026) that year.

After a Peru insurer data breach, holders of an Interseguro policy should be wary of messages that quote their ID or policy number. The company says the stolen data cannot be used for transactions, but contact details and ID numbers are enough for phishing.

For investors in the group’s New York-listed shares, the case is a regulatory and reputation risk, not a proven financial loss. Our profile of Intercorp Financial Services shows how the group is built.

Readers who want the wider picture can open our guide to who runs Peru’s economy . It maps the main companies and families that shape the country’s economy.

Interseguro has not said how many customers are affected, when the intrusion began or how the attackers got in. It has not said whether it received a ransom demand.

It is also open whether any stolen files have been published or whether a sanctions case will follow. The insurer says its investigation is still running.

The Peru insurer data breach hit Interseguro, which says an unauthorized party accessed information about a group of its customers. It detected the access on 7 October and reported it to the authorities.

The insurer says the records mainly hold identification data, contact data and policy numbers. A hacker group claims to hold much more, but that claim is not confirmed.

Interseguro is a unit of Intercorp Financial Services, which also owns Interbank and Inteligo. The parent group’s shares trade on the New York Stock Exchange and in Lima under the ticker IFS.

The SBS says it is monitoring the Peru insurer data breach and collecting information on the origin, the compromised data and the forensic results. It will then check whether the insurer complied with cybersecurity rules.

Interseguro says the data cannot be used to carry out transactions on a policy. Customers should still watch for phishing messages that use their ID or policy number.

Sources: El Comercio, Interseguro reports unauthorized access and notifies clients , 13 October 2026; El Comercio, SBS on possible Interseguro data leak , 15 October 2026; El Comercio, Indecopi on alleged Interseguro data leak , 15 October 2026; Infobae Peru, Interseguro faces alert over alleged data leak , 13 October 2026; Peru Retail, Interseguro confirms customer data breach , 14 October 2026; Intercorp Financial Services, 2025 annual report (Form 6-K, US Securities and Exchange Commission) , 2026.

Editorial responsibility: Matthias Camenzind , Editor-in-Chief · Editorial standards · Report an error